> , it can lead to complete device compromise.
lile they had on the flagship pixels just 8mo ago.
the csv google downgraded the severity because there was a work around of "disabling 5/4g" in a market that offset 3g. heh.
lile they had on the flagship pixels just 8mo ago.
the csv google downgraded the severity because there was a work around of "disabling 5/4g" in a market that offset 3g. heh.
https://googleprojectzero.blogspot.com/2023/03/multiple-inte...
> The four most severe of these eighteen vulnerabilities ... allowed for Internet-to-baseband remote code execution
Affected the Pixel 6 and 7, among other devices.
also, it was the first update to be delayed over 40days from the usual calendar. because the issue was seen in the wild a week before the release date so they scrambled to include a patch and delayed everything
baffles me that people here fall for this simplistic excuse of "it just corrupt memory"
or things like "the modem is isolated from the phone". sigh. how do you think they configure your phone via a text message? the protocol is safe but the payload is crazy powerful and trivial to abuse.
no phone expects the modem to be an adversary. and every modem firmware is wide open. everyone just pretend it's not and hope the NDAs will work keeping the modem security holes from falling into the wrong hands. heh.