GM!

#GrapheneOS version 2024011600 is out now! This is mostly quality of life improvements.

See the changes:

- Work around upstream Android bug causing system_server crash due to failed security-related assertion by denying the action without crashing system_server, which avoids turning a buggy security check into a denial of service issue

- Add workaround for upstream Android crash reporting bug recording clean f2fs filesystem check results as errors which is resulting in many users receiving filesystem check error reports on GrapheneOS due to our user-facing notifications for serious errors/crashes

- Add workaround for upstream Android crash reporting bug causing old crashes to be reported again

-Add workaround for upstream Android crash reporting bug wrongly attributing certain app crashes to system_server

- only show kernel crashes when the user opts into system crash notifications since there are many false positives caused by hardware issues such as some users having devices which sometimes fail to resume from sleep while idle

- only show report button in log viewer for system_server Java/native crashes, MTE crashes and filesystem check errors (which now have non-error results properly filtered out) due to receiving too many reports about upstream bugs and hardware issues

- hide specific system apps and also sandboxed Google Play from Aurora Store so users don't try to update them through it and receive errors

- Log Viewer: explicitly set status bar color to fix light mode icon colors

https://grapheneos.org/releases#2024011600

In addition, #Vanadium version 120.6099.230.0 is now available. This release adds the upstream fixes of 4 (3 high) CVEs, one allegedly being exploited in the wild.

Here is information by Google on these vulnerabilities for the Desktop equivalents:

https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html

As noted in the article, many of the Chromium security bugs are detected thanks to a variety of security technologies like Control Flow Integrity. While CFI is not enabled on almost all platforms, Vanadium enables it. In addition, Vanadium remains one of the only actively maintained browsers inheriting this feature on Android.

While the details of these CVEs are not entirely public yet, the fact they effect V8 could indicate a vulnerability incorporating JIT. Vanadium disabling this by default would have made their users already unaffected by this vulnerability if this turns out to be the case.

#GrapheneOS

nostr:nevent1qqsqp5xsyhygrftumts9dea2vn5jnyed8xzydz7amtma7w673kz9dgspz3mhxue69uhhyetvv9ujumn0wd68ytnzvupzps26tfjesmn6ksf5mm36hpf9fkjut49sfeutfutvs2phrykn25v9qvzqqqqqqydjzhxh

Reply to this note

Please Login to reply.

Discussion

No replies yet.