Vulnerability, Where Art Thou? An Investigation of Vulnerability Management in Android Smartphone Chipsets

Vulnerability, Where Art Thou? An Investigation of Vulnerability Management in Android Smartphone Chipsets

Speakers: Daniel Klischies

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=TDYqShXmKiY

Overview

While much attention in Android security research typically focuses on application vulnerabilities or issues within the Android operating system itself, a critical and often overlooked area is the underlying hardware: the smartphone chipset. These complex components are responsible for fundamental device functionality, from running Android to enabling cellular connectivity. Despite their pervasive role, a large-scale, systematic study into how vulnerabilities in these chipsets are discovered, managed, and patched has been conspicuously absent. This talk, presented by Daniel Klischies at the NDSS Symposium, addresses this gap by presenting a comprehensive investigation into the vulnerability management landscape of Android smartphone chipsets.

Klischies highlights the fragmented nature of information surrounding chipset vulnerabilities, which is scattered across websites of various involved parties—chipset manufacturers, smartphone manufacturers, and the Android project. To overcome this, the research team developed a powerful knowledge base that aggregates and correlates this disparate data. This ambitious undertaking has yielded invaluable insights into the origins of vulnerabilities, the effectiveness of discovery mechanisms, and the often-protracted timelines for patch delivery, illuminating critical weaknesses in the current ecosystem. The findings are not merely academic; they carry significant implications for the security posture of billions of Android devices worldwide, offering a roadmap for both researchers and industry stakeholders to enhance the resilience of the mobile platform.

Background

▶ Watch: Introduction to chipset vulnerability management challenges (0:00)

To appreciate the complexities of chipset vulnerability management, it's essential to understand the architecture of an Android smartphone and its intricate supply chain. At the core of every Android device is the application processor, which hosts the Android operating system. This processor communicates via a bus with several co-processors, such as the cellular baseband modem or the Bluetooth modem. Each co-processor runs its own dedicated firmware, specifically designed for its unique function. Complementing this hardware, a corresponding driver runs on the application processor, enabling Android to leverage the co-processors' capabilities. Crucially, the hardware components, their firmware, and the associated drivers are not developed by smartphone manufacturers. Instead, they are created by specialized chipset manufacturers.

The supply chain for Android devices is inherently complex and multi-layered. Chipset manufacturers develop and supply these core components (chipsets, drivers, firmware) to smartphone manufacturers. These smartphone manufacturers then integrate the chipsets with other peripherals like displays, cameras, and batteries, add their customized version of Android, and assemble the final smartphone. Vulnerabilities are typically introduced accidentally during the chipset manufacturers' development process. Once discovered, ideally by academic researchers, bug bounty hunters, or the chipset manufacturers' internal product security teams, the vulnerability is reported. The chipset manufacturer then analyzes the flaw, determines affected chipset models and severity, and develops a patch. However, they cannot directly deploy this patch to end-users. Instead, the patch is supplied to the smartphone manufacturer, who integrates it into an over-the-air (OTA) update for Android, which is then distributed to devices. This convoluted process, which the researchers term the "chipset vulnerability life cycle," is further complicated by the fact that all relevant information—from vulnerability details to patch availability and device updates—is dispersed across numerous, often siloed, public websites. This lack of centralized, easily accessible data forms the fundamental problem that Klischies's research aims to solve.

Key Findings

▶ Watch: Developing a comprehensive knowledge base for chipset vulnerabilities (3:22)

The comprehensive knowledge base developed by Klischies and his team, which currently encompasses over 3,600 chipset vulnerabilities affecting more than 430 chipset models used in over 6,800 phone models, alongside data on approximately 18,000 smartphone updates, yielded several critical insights into the state of Android chipset security.

One of the most striking findings concerns vulnerability persistence and code sharing across chipset generations. The study revealed that for any given chipset model, a staggering 93% of vulnerabilities could already be found in a previous chipset model developed by the same manufacturer. Furthermore, 91% of these vulnerabilities persist into future chipset models, with only about 9% being removed. This indicates a high degree of code reuse for legacy functionality (e.g., LTE, GSM, older Wi-Fi standards) across generations, which is economically sensible for manufacturers but creates a significant security debt. It implies that security researchers should not solely focus on the latest features but can find substantial value in scrutinizing older, persistent codebases. For chipset manufacturers, this means that discovering a vulnerability in one chipset model necessitates a thorough investigation across potentially all their product lines to identify other affected models, a process that can be time-consuming and resource-intensive.

Regarding vulnerability discovery, the research highlighted varying levels of internal security capabilities among major chipset manufacturers. In 2023, Qualcomm and Samsung demonstrated strong internal product security teams, discovering more than 50% of vulnerabilities in their own products. In stark contrast, MediaTek and UNISOC found less than 25% of vulnerabilities internally, indicating a much higher reliance on external researchers. While bug bounty programs are in place to attract external contributions, this reliance raises concerns about the consistency and comprehensiveness of vulnerability discovery, as there's no guarantee that external researchers will continuously target these components or report all findings. Positively, the study found that all chipset manufacturers have functional reporting systems and generally take reported vulnerabilities seriously, indicating a commitment to addressing security flaws rather than attempting to conceal them.

The study also shed light on the often-protracted and uncoordinated patching timelines. Once a vulnerability is found, chipset manufacturers take an average of 91 days to provide a patch for 25% of vulnerabilities, extending to more than 320 days for 95% of vulnerabilities. This initial delay is only the first step. After receiving the patch, smartphone manufacturers then take an additional 44 days to update 25% of affected phones, and a significant 266 days to patch 95% of affected smartphone models via OTA updates. This wide spread in update deployment—where some models are patched quickly while others lag substantially—creates a critical window of exposure. Threat actors could analyze early patches, develop exploits, and target the large number of devices that remain unpatched for extended periods. The researchers conclude that updates are generally not well coordinated across different phone models. Furthermore, the widely accepted 90-day disclosure period for vulnerabilities is almost never met by either chipset or smartphone manufacturers, sparking a crucial discussion within the security community about whether this standard is realistic or appropriate for the complex Android chipset ecosystem.

Technical Deep Dive

▶ Watch: Key Insight: 93% of vulnerabilities persist across chipset generations (4:50)

The cornerstone of this research is the meticulously constructed knowledge base, designed to overcome the inherent fragmentation of information within the Android chipset vulnerability ecosystem. The researchers recognized that critical data points—such as which chipsets are affected by a specific vulnerability, which phone models utilize those chipsets, and when patches become available—are scattered across numerous, often siloed, public sources.

To address this, Klischies and his team developed a robust aggregation methodology. Their knowledge base systematically collects information from several key sources:

1. Android Security Bulletins (ASBs): These monthly bulletins from Google detail vulnerabilities affecting Android components, including those in chipset drivers and firmware.
2. Chipset Manufacturer Websites: Sites from companies like Qualcomm, MediaTek, Samsung, and UNISOC often publish advisories or security bulletins detailing vulnerabilities specific to their products, listing affected chipset models.
3. Smartphone Manufacturer Websites: OEMs (Original Equipment Manufacturers) like Samsung, Google, Xiaomi, etc., provide information on which of their phone models receive specific security updates and sometimes detail the underlying vulnerabilities.
4. National Vulnerability Database (NVD): A U.S. government repository of standards-based vulnerability management data, including CVEs (Common Vulnerabilities and Exposures) that often link to chipset-related flaws.
5. Product Databases: Publicly available databases that map specific smartphone models to the chipsets they incorporate.

The aggregation process involves correlating these disparate data points. When a CVE (Common Vulnerabilities and Exposures) is identified, the researchers cross-reference it with chipset manufacturer advisories to determine the specific chipset models affected. Subsequently, by consulting their internal database that maps phone models to their integrated chipsets, they can accurately identify all smartphone models potentially vulnerable to that specific CVE. This systematic linking forms the backbone of their ability to determine the widespread impact of a vulnerability.

The scale of this knowledge base is impressive, currently holding data on over 3,600 unique chipset vulnerabilities, impacting more than 430 distinct chipset models from all major manufacturers. These chipsets are deployed in over 6,800 different smartphone models, and the database also tracks approximately 18,000 smartphone updates. The system is designed for continuous updating, ensuring the data remains current as new vulnerabilities are discovered and patches are released.

Furthermore, to provide a more nuanced understanding of a device's current security posture, the researchers go beyond simply identifying which phones were vulnerable. For a significant portion of the smartphone market (representing over 50% of brands, primarily the largest OEMs), they download and analyze update changelogs. By parsing these changelogs, they can determine if a specific phone model has received an update that addresses a known vulnerability, thereby assessing whether the device is still vulnerable. This capability adds a crucial layer of real-world relevance to their data, moving beyond theoretical vulnerability to actual device status. The entire knowledge base is not only stored in a robust backend database but also powers a publicly accessible website, providing an intuitive interface for users to explore the data, drill into specific vulnerabilities, and understand affected products.

Demo / Proof of Concept

▶ Watch: Key Insight: Analysis of internal vs. external vulnerability discovery (6:40)

While the talk did not feature a live, interactive demonstration in the traditional sense, the core "proof of concept" is the operational knowledge base and its accompanying website. This platform serves as a powerful tool, showcasing the practical utility of the aggregated data and enabling several key use cases that were previously impossible due to fragmented information.

The website allows users to:

1. Identify Vulnerability Trends: Researchers and security analysts can leverage the historical data to discern patterns in vulnerability introduction. This includes identifying which chipset components (e.g., specific modem functionalities, Wi-Fi modules) are more prone to severe vulnerabilities based on past occurrences. Conversely, it can highlight components that have historically shown fewer flaws, potentially warranting increased scrutiny as "under-researched" areas. This capability empowers targeted vulnerability discovery efforts.
2. Design Diverse Smartphone Test Sets: Recognizing the prevalence of code sharing and vulnerability persistence across chipset generations, the website offers a unique utility for vulnerability researchers. It can help design a diverse set of smartphones for testing new vulnerability discovery methods. The tool aims to provide a selection of smartphone models whose underlying chipsets do not have highly overlapping sets of vulnerabilities. This ensures that researchers are testing a broader range of distinct codebases, rather than repeatedly testing variations of the same vulnerable code.
3. Determine Widespread Impact of New Vulnerabilities: For a researcher who has just discovered a new smartphone vulnerability and received a CVE, a common challenge is understanding the full scope of its impact. While chipset manufacturers typically list affected chipset models, identifying all the specific smartphone models that incorporate those chipsets and are therefore vulnerable has historically been difficult. The knowledge base's website directly addresses this by allowing users to input a vulnerability (e.g., via its CVE or a known affected chipset) and instantly receive a comprehensive list of all affected smartphone models. This crucial capability provides immediate, actionable intelligence for both researchers and end-users, facilitating better understanding of risk and the urgency of patching.

These functionalities demonstrate that the project is not just a theoretical study but a practical, continuously updated resource that empowers the security community to navigate the complexities of Android chipset vulnerabilities more effectively.

Defensive Implications

▶ Watch: Positive note: Vulnerabilities are taken seriously by manufacturers (7:50)

The findings presented by Daniel Klischies carry significant implications for various stakeholders involved in the Android ecosystem, demanding strategic defensive actions to enhance overall security.

For chipset manufacturers, the most prominent implication is the need to address legacy code. The discovery that 93% of vulnerabilities persist from previous models and 91% carry into future ones underscores that old code is a continuous source of new vulnerabilities. Manufacturers must prioritize comprehensive security audits, static and dynamic analysis, and perhaps even refactoring efforts for these long-lived codebases. Furthermore, given the broad impact of vulnerabilities across multiple product lines, internal product security teams need to improve their capability to conduct thorough cross-product impact assessments immediately upon vulnerability discovery, rather than relying on researchers to do this work. Investing more in internal security research and bug hunting, particularly for companies like MediaTek and UNISOC that currently show a higher reliance on external researchers, would also bolster their defensive posture.

Smartphone manufacturers bear the responsibility for delivering patches to end-users. The significant delays (up to 266 days for 95% of devices) and lack of coordination across different phone models are critical areas for improvement. OEMs must streamline their OTA update processes, potentially by allocating more resources, improving internal testing, and establishing tighter coordination protocols with chipset manufacturers. The observed disparity in patching timelines between the first few devices and the majority of models creates a dangerous window of opportunity for threat actors. Better internal coordination and a commitment to more uniform patch deployment across their product portfolios are essential.

For external security researchers and bug bounty hunters, the research provides clear guidance: don't neglect legacy components. Focusing on older, persistent codebases, which are less likely to be re-implemented and thus carry vulnerabilities across generations, can yield significant findings. The knowledge base itself serves as a valuable tool for identifying high-impact targets and understanding the widespread effect of their discoveries.

From a broader ecosystem perspective, the consistent failure to meet the 90-day disclosure deadline by both chipset and smartphone manufacturers suggests a systemic issue. The community should engage in a serious discussion about whether this deadline is realistic for the complex, multi-vendor Android supply chain. Perhaps a more flexible or tiered disclosure policy, tailored to the realities of this environment, could lead to more transparent and ultimately more effective vulnerability management without unduly increasing risk.

Ultimately, the defensive implications point towards a need for greater transparency, coordination, and shared responsibility across the entire Android supply chain. Chipset manufacturers, smartphone manufacturers, and even OS developers like Google need to work more closely to accelerate patch development and deployment, reduce the attack surface presented by persistent legacy code, and ensure that the security of Android devices keeps pace with the evolving threat landscape.

Key Takeaways

• Vulnerability Persistence is Systemic: Over 90% of vulnerabilities in Android smartphone chipsets are found in previous models and persist into future generations, highlighting extensive code reuse in legacy functionality.
• External Researchers are Crucial: While some manufacturers (Qualcomm, Samsung) have strong internal security teams, others (MediaTek, UNISOC) heavily rely on external researchers and bug bounty programs for vulnerability discovery.
• Patching Timelines are Protracted and Uncoordinated: It takes chipset manufacturers over 320 days to provide patches for 95% of vulnerabilities, and smartphone manufacturers an additional 266 days to update 95% of affected phones, creating significant exposure windows.
• 90-Day Disclosure is Often Unmet: The industry-standard 90-day disclosure period is rarely adhered to by either chipset or smartphone manufacturers, prompting a discussion about its realism in this complex supply chain.
• The Knowledge Base is a Vital Resource: The developed knowledge base, aggregating data from diverse sources, provides unprecedented visibility into chipset vulnerabilities, affected devices, and patching status, offering powerful tools for researchers and defenders.
• Focus on Legacy Code: Researchers should prioritize scrutinizing legacy chipset components, as they are a fertile ground for discovering new vulnerabilities that persist across multiple product generations.

About the Speaker(s)

Daniel Klischies is the researcher who presented this detailed investigation into vulnerability management in Android smartphone chipsets at the NDSS Symposium. His work highlights a critical area of mobile security that has historically lacked comprehensive study, providing valuable insights and tools for the security community.