The kernel also still plays a vital and security-meaningful role in processing calls from applications.
Running an out of date kernel could mean strangers ransoming your data, or could mean an attack becomes persistent and starts logging and uploading through reboots.
Running an out of date kernel often does not result in this, and that higher level security matters first.
However, the kernel does have an attack surface through those higher levels, and pwning the kernel still means something.
Those datacenters are running LTS kernels with minor versions updated, or have security patches backported, or have far more limited connections to the world than your phone — only one protocol, one port, one service, for example.
One example, since you asked: https://thehackernews.com/2019/10/android-kernel-vulnerabili...
> Smartphones aren’t servers, but they run tons of services that
> interact with the surrounding world. Bluetooth, WiFi, etc…
The issue you note is only exploitable via a bug if you have an outdated version of the chrome browser. You don't need to update the kernel, in order to update an application.
Seriously, I feel like I'm talking to my wife here, who is not a tech person. Why are you and the other couple of people being purposely dense, and purposely ignoring the content of your own links that doesn't fit your viewpoint?
BTW, after you said smartphones aren't servers, you go on to talk about why an older kernel is bad on servers.
But since you asked, the latest 4.9.3 kernel running on that nexus6 from 2014, that's been compiled appears to be from the end of the year 2019.
If everyone around you is stupid, then maybe you don’t understand the topic at hand?
This is after one hasty search. https://source.android.com/security/bulletin/2016-10-01
There are various kernel level vulnerabilities listed. Some weakening privacy over tcp connections, others locally exploitable via a malicious app such as Pegasus.
I don't understand why you call him confused. Perhaps you can approach with curiosity instead.
In those five minutes of looking through your garbage dump, I found Zero vulnerabilities that do not need either you installing a virus, which then gets root (the vulnerability), or a bug in an application running as root that's out of date, which then of course gives the attacker of the application root. None of those are valid examples, and I'm now bored digging through random garbage.
Any hack, in Any application, will give the attacker root - we're running rooted phones (for the extra functionality).
If you want to make a point, note the actual bug listed that does not need a compromised application. You installing a virus then the virus getting root does not count. The thread is about a kernel bug giving a remote attacker control of your phone. Applications and drivers like your modem can be updated without you updating the kernel. The latest N6 kernel is 4.9.3, with updates from the end of 2019.
Also, regarding your previous post, modern Android and ios is lightyears ahead in security than any desktop os out there, for good reason (majority of people interact with their phones, and store much more sensitive data there)
yes. always have. same in windows where I also don't use antivirus. and this is what most tech people do for their personal equipment. because the one issue I had, in my 30+ years of using computers, and 20+ years of doing it professionally as a dev, sysadmin, and storage admin, I only once got a virus.
i'll tell you a little secret too. yes, it's wtf to people who don't know what they're doing and need the safeguard against when they screw up. I know enough to not screw up. now go pipe a bash script from a webpage to sh to install something, because that's what the installation manual for your game said to do.
Running anything under root is just insanely stupid.
> I had my nexus6 on kernel 4.9.3.
I find this very hard to believe, as no evidence of Nexus 6 kernels that are not Google's original 3.10 shipped exists that I can find. Even PostmarketOS that looks to update kernels links to LineageOS fork of the 3.10 kernel on their page for shamu/Nexus 6.
Unless you mean a custom kernel from "some guy on XDA" that names itself 4.9.3 like this one - which is just kernel 3.10 with some branding on it. It says so right in its description: https://forum.xda-developers.com/t/kernel-sm-4-9-3-o3-graphi... . Kernel 4.9.3 is a weirdly specific point release to be on in modern times anyway - there's kernel 4.9.0 all the way up to 4.9.287 - so it'd definitely be oddly specific if that's what you had.
Outside of valiant community efforts like Replicant and PostmarketOS, who have an extremely hard time getting working or feature complete kernels running, Android devices getting new kernels is almost unheard of. Even with vendor support. Community ROMs have to stick with what the vendor gave them to have a functional device.
Your car has pieces that run linux too. Guess an attacker can make you crash.
> drivers
since this is about iphone and android comparison, guess what has those same driver blobs form those same exact manufacturers. apple doesn't make their own bluetooth chips. oh, btw, the drivers get updated just fine, since that's part of the kernel and os, which all get updated just fine.
google supports kernel 4.1 till 2024 for android 11. the nexus from 2014 runs 4.9. so probably 2026 kernel and android, fully patched - 12 years.
oh, sorry, did you forget this thread started with a guy claiming ios is great because you can put later versions of the OS on there? where's that iphone from 12 years ago running the latest version of ios, and still performing fast? because that's what this thread is about.
> Your car has pieces that run linux too. Guess an attacker can make you crash.
Actually, yes... https://www.wired.com/2015/07/hackers-remotely-kill-jeep-hig... http://www.autosec.org/pubs/cars-usenixsec2011.pdf
> the drivers get updated just fine, since that's part of the kernel and os, which all get updated just fine.
Just because the kernel is getting updated does not mean the drivers and firmware are also getting updated. Drivers are specific to hardware, and if a vendor stops shipping updates for some chip that is no longer used in newer phones, then you aren't going to get updates for that chip.
> since this is about iphone and android comparison
This isn't about iphone and android comparison, not for me. You made naive claims about kernels not having attack surface and unimportance of staying updated, and I am responding to those claims.
In addition, I'm unsure why you think you can't update the kernel on a phone. In fact, updating the kernel is standard procedure for... pretty much all directions on flashing a custom ROM. I had my nexus6 on kernel 4.9.3. There are literally new phones, right now, selling with that kernel version and earlier, with android11.
This is like saying windows server 2016 has a kernel that's outdated, or that windows 10 which came out in 2015 is outdated.
I think you are extremely confused.
>I really don’t recommend
Which is a good thing, because you should not be recommending about things you do not understand on even a basic level.
>After that, it’s probably left up to the community.
right. the entire point of my post. you can load stuff from the community. which includes the community of things like lineage - a big official community that's an llc - a corporation like redhat.
A phone is not a server. It is not a security risk to run an outdated kernel. there are no services running a hacker can connect to. You don't connect to a kernel over the internet. A kernel which is by no means out of date, and is currently running in many datacenters.