Hacker News Reader

Hacker News

Comment by JeremyNT | Hacker News Reader

Parent Full thread

JeremyNT

Unneeded on pixel devices per the project zero announcement [0]:

> affected Pixel devices have already received a fix for CVE-2023-24033 in the March 2023 security update

[0] https://googleprojectzero.blogspot.com/2023/03/multiple-inte...

View on HN

I am still running the February update on my Pixel 6. When I check for updates, I don't see one.

+1, no March update on pixel 6a yet

Chiming in to say the same thing.

+1 too.

But some Pixel phones haven't gotten the March 2023 security update yet, per the article.

> affected Pixel devices have already received a fix for CVE-2023-24033 in the March 2023 security update

That line is carefully deceptive (lawyerly, even). Pixel 6 series have not yet received the March 2023 update.

The patch was written but withheld due to bugs. So you are not patched yet.

Hi Matthew, could you provide a source? I thought the fix was already being rolled out (or about to get rolled out for the Pixel 6).

Yes I think it was a week late but is now being rolled out. People on Twitter are saying they don’t have it yet, which is the nature of individual experience.

https://9to5google.com/2023/03/06/march-google-pixel-update-...

Google Support said that the Pixel 6 series won't be updated until March 20. This seems horrific to me.

Today is March 23rd. There has been no pixel 6 update since March 5

https://www.youtube.com/watch?v=FKyrni9s8Ew

That is only for CVE-2023-24033 thought, right? Not the other three that haven't been assigned CVE ID's?

> The four most severe of these eighteen vulnerabilities (CVE-2023-24033 and three other vulnerabilities that have yet to be assigned CVE-IDs) allowed for Internet-to-baseband remote code execution.

Ah, that would explain the multiple patches that came in last week on my 7 Pro. I thought it was strange.

Reply on news.ycombinator.com