News for hackers. Stuff that matters.
Re:Hardening the Kernel in Android Oreo by khc on Wednesday August 30, 2017 @04:54PM (#15135913)
"Android 8.0 makes KASLR available in Android kernels 4.4 and newer."

And yet on my pixel with Android 8.0, I am only using 3.18.52. Who actually ships Android with kernel 4.x?

Re:Hardening the Kernel in Android Oreo by tetromino_ on Wednesday August 30, 2017 @08:31PM (#15137251)
OnePlus ships modern kernels.

My OnePlus 5 is using kernel 4.4.21 - this is with Nougat 7.1.1, by the way; no Oreo here yet.

Re:Hardening the Kernel in Android Oreo by murderfs on Thursday August 31, 2017 @02:29AM (#15138533)
OnePlus ships the kernel that Qualcomm gives them. The BSP for Snapdragon 835 (aka msm8998) is based on 4.4
Re:Hardening the Kernel in Android Oreo by khc on Wednesday August 30, 2017 @09:22PM (#15137444)
Ok I am very disappointing with Google in that case
Re:Hardening the Kernel in Android Oreo by forkbomb_ on Thursday August 31, 2017 @02:26AM (#15138520)
The kernel you get is entirely up to the SoC vendor.

Snapdragon 820/821 ships with 3.18. Snapdragon 830 ships with 4.4. Snapdragon 830+1 will ship with 4.9

There's a huge amount of work involved in porting a chipset from one kernel version to another. While I'm sure Google _could_ do it, it's ultimately not worth their while - they'd probably lose support from Qualcomm, and if they hit any weird bugs they'd be on their own.

Re:Hardening the Kernel in Android Oreo by MBCook on Wednesday August 30, 2017 @05:26PM (#15136184)
I was surprised to read that in the article.

New android phones from top vendors (not the $50 junk devices) ship with 3.x kernels?

Wow.

Re:Hardening the Kernel in Android Oreo by fooker on Wednesday August 30, 2017 @05:47PM (#15136331)
3.x kernels with security patches. What seems to be the issue?

You can claim big rewards from Google if you report kernel exploits in Android.

Re:Hardening the Kernel in Android Oreo by gsnedders on Wednesday August 30, 2017 @05:57PM (#15136436)
> 3.x kernels with security patches. What seems to be the issue?

Limiting the scope of vulnerabilities before they are patched.

There's plenty of more recent defence-in-depth work that will make some vulnerabilities impossible to exploit on more recent kernels, and while they will get patched on the older kernels it'd still be nicer if they weren't exploitable in the first place.

Re:Hardening the Kernel in Android Oreo by MBCook on Wednesday August 30, 2017 @08:26PM (#15137231)
Even without that there are lots of power saving fixes that get put into Linux with every release. That kind of stuff seems like it be very important in a phone as well.
Re:Hardening the Kernel in Android Oreo by kllrnohj on Wednesday August 30, 2017 @09:19PM (#15137432)
Given Android has its own power management story independent of what upstream is doing those power changes are unlikely to be relevant or significant to Android.
Re:Hardening the Kernel in Android Oreo by MBCook on Wednesday August 30, 2017 @09:29PM (#15137467)
I know (vaguely) that android has its own power management system, and I don't know how much it ties into what the kernel uses on a standard laptop.

But the changes to the normal kernel one as well as some of the changes in data structures are algorithms designed to be more efficient in the first place are probably still useful.

Re:Hardening the Kernel in Android Oreo by mrmondo on Thursday August 31, 2017 @09:38AM (#15140173)
4.4 is old. Technology - especially software moves fast and it’s been 9 months since 4.4 was released. There’s been a lot of security, performance and feature improvements since 4.4 was released.

Major and/or userland problems don’t tend to occur as the kernel gets developed and released. There are major advantages in accepting new subsystem code over patched ‘legacy’ code.

Re:Hardening the Kernel in Android Oreo by trthomps on Wednesday August 30, 2017 @05:07PM (#15136043)
I also have 3.18 on my Pixel XL. I assume the unreleased Pixel 2 devices will be running kernel 4.4 if that's what they targeted.

They probably wanted to back port it to 3.18 but it was too much work. I'm pretty disappointed they didn't move the Pixel forward to a new kernel though, this seems to be one of the biggest issues with Android.

Re:Hardening the Kernel in Android Oreo by wmf on Wednesday August 30, 2017 @08:50PM (#15137322)
This is an interesting case study in development cycles. The Pixel XL from October 2016 uses the Snapdragon 82x released in July 2016 but first announced in March 2015 and it uses a kernel from 2014 which gives us a hint about when driver development started.
Re:Hardening the Kernel in Android Oreo by khc on Wednesday August 30, 2017 @05:19PM (#15136125)
I hope so, but given that 3.18 was released almost three years ago I am not holding my breath.
Re:Hardening the Kernel in Android Oreo by pjmlp on Wednesday August 30, 2017 @05:12PM (#15136085)
Quite disappointing, yet another bad example for OEMs.
Re:Hardening the Kernel in Android Oreo by Moral_ on Wednesday August 30, 2017 @06:19PM (#15136599)
The new pixel 2 phones coming out in October are on 4.4
Re:Hardening the Kernel in Android Oreo by salcoco on Monday September 04, 2017 @03:00PM (#15170197)
I got the OnePlus 5 and it has kernel 4.4.21 tho using android 7.1
Re:Hardening the Kernel in Android Oreo by ajtaylor on Thursday August 31, 2017 @01:55AM (#15138411)
My Galaxy S8 is running kernel 4.4.16
Re:Hardening the Kernel in Android Oreo by ibrahima on Wednesday August 30, 2017 @06:58PM (#15136832)
My Nexus 5X, only a year older than your Pixel, is on 3.10, so it got none of these updates :(