It's a little confused. Stagefright is just a library containing the exploit. The component being (presumably) exploited is the mediaserver process. This is where almost all video decode/encode handling happens in Android (and other related stuff, like audio and camera).

And yes, the mediaserver has internet access so that it can fetch and decode streams on its own without forcing all I/O to go through a user process. Basically it's a performance optimization, though indeed probably one necessitated by having to wall off all that DRM handling in the first place.

That said, mediaserver, while it has lots of access to things that Android apps don't (e.g. open file descriptors to kernel vendor-specific drivers with lets-just-say-questionable security practices), is not a root process. And it's reasonably sandboxed in recent Android versions using selinux. An exploit into it may not be quite as device-cracking as is being claimed.

Still, not a good thing at all.

> And it's reasonably sandboxed in recent Android versions using selinux.

Is it safe to assume that this attack vector is not a concern with Android 5.1? (or later)

Certainly not, because the plausible kernel bugs in those open driver descriptors (I'm serious: vendor media drivers are not pretty things) would obviously not be subject to selinux controls.

But at least there is some sandboxing in place; the security architecture was designed to admit the possibility of a breach of the mediaserver.

According to the reddit discussion, 5.1.1 is demonstrated to be vulnerable (so it affects everything 2.2 and later).

Link to that reddit thread? AFAICT, all current claims are for a crash exploit into libstagefright, not a breakout of the mediaserver to (for example) persistently write a payload/rootkit.

Let's not forget the companies that not just caved to Hollywood, but actively promoted their ideas at W3C and so on (see EME, etc).

They share the blame, too. They can't all just throw their hands up in the air and say "they made us do it".

Considering that perspective, the irony of the name "Stagefright" is not lost.

I don't see any mention of Stagefright in the article.

Looks like the moderators switched out the article. It used to point to this one https://threatpost.com/android-stagefright-flaws-put-950-mil...

"The problem is that Stagefright is an over-privileged application with system access on some devices, which enables privileges similar to apps with root access. Stagefright is used to process a number of common media formats, and it’s implemented in native C++ code, making it simpler to exploit

This is huge.