Google has begun to roll out their monthly security patch to Nexus devices along with the Pixel C, with this update being built for the month of March 2016. According to the March security bulletin board, there are 16 fixes made to the software ranging from moderate to critical in severity. These bugs and issues were discovered by the Android and Chrome security teams alongside other independent researchers.
Here’s a rundown of all the bugs fixed in this month’s security patch:
Issue | CVE | Severity |
---|---|---|
Remote Code Execution Vulnerability in Mediaserver | CVE-2016-0815 CVE-2016-0816 |
Critical |
Remote Code Execution Vulnerabilities in libvpx | CVE-2016-1621 | Critical |
Elevation of Privilege in Conscrypt | CVE-2016-0818 | Critical |
Elevation of Privilege Vulnerability in the Qualcomm Performance Component |
CVE-2016-0819 | Critical |
Elevation of Privilege Vulnerability in MediaTek Wi-Fi Driver | CVE-2016-0820 | Critical |
Elevation of Privilege Vulnerability in Keyring Component | CVE-2016-0728 | Critical |
Mitigation Bypass Vulnerability in the Kernel | CVE-2016-0821 | High |
Elevation of Privilege in MediaTek Connectivity Driver | CVE-2016-0822 | High |
Information Disclosure Vulnerability in Kernel | CVE-2016-0823 | High |
Information Disclosure Vulnerability in libstagefright | CVE-2016-0824 | High |
Information Disclosure Vulnerability in Widevine | CVE-2016-0825 | High |
Elevation of Privilege Vulnerability in Mediaserver | CVE-2016-0826 CVE-2016-0827 |
High |
Information Disclosure Vulnerability in Mediaserver | CVE-2016-0828 CVE-2016-0829 |
High |
Remote Denial of Service Vulnerability in Bluetooth | CVE-2016-0830 | High |
Information Disclosure Vulnerability in Telephony | CVE-2016-0831 | Moderate |
Elevation of Privilege Vulnerability in Setup Wizard | CVE-2016-0832 | Moderate |
Normally, you can expect the patch to hit your device in about a week, however if you’re impatient, you can download the appropriate factory image for your device you can flash manually.
- Pixel C
- Nexus 6P
- Nexus 5X (2)
- Nexus 6
- Nexus Player
- Nexus 9 (LTE)
- Nexus 9 (Wi-Fi)
- Nexus 5
- Nexus 7 2013 (Wi-Fi)
- Nexus 7 2013 (Mobile)
Google has provided users with a guide on how to flash the image to your device. As I don’t currently have one personally, I thought I’d add Google’s to this report for reference.
Flashing Instructions
To flash a device using one of the system images below (or one of your own), you need the latest
fastboot
tool. You can get it from one of the sources below.
- From a compiled version of the Android Open Source Project.
- From the
platform-tools/
directory in the Android SDK. Be sure that you have the latest version of the Android SDK Platform-tools from the SDK Manager.Once you have the
fastboot
tool, add it to yourPATH
environment variable (theflash-all
script below must be able to find it). Also be certain that you’ve set up USB access for your device, as described in the Using Hardware Devicesguide.Caution: Flashing a new system image deletes all user data. Be certain to first backup any personal data such as photos.
To flash a system image:
- Download the appropriate system image for your device below, then unzip it to a safe directory.
- Connect your device to your computer over USB.
- Start the device in fastboot mode with one of the following methods:
- Using the adb tool: With the device powered on, execute:
adb reboot bootloader- Using a key combo: Turn the device off, then turn it on and immediately hold down the relevant key combination for your device. For example, to put a Nexus 5 (“hammerhead”) into fastboot mode, press and hold Volume Up + Volume Down + Power as the device begins booting up.
- If necessary, unlock the device’s bootloader by running:
fastboot flashing unlockor, for older devices, running:
fastboot oem unlockThe target device will show you a confirmation screen. (This erases all data on the target device.)
- Open a terminal and navigate to the unzipped system image directory.
- Execute the
flash-all
script. This script installs the necessary bootloader, baseband firmware(s), and operating system.Once the script finishes, your device reboots. You should now lock the bootloader for security:
- Start the device in fastboot mode again, as described above.
- Execute:
fastboot flashing lockor, for older devices, running:
fastboot oem lockLocking bootloader will wipe the data on some devices. After locking the bootloader, if you want to flash the device again, you must run
fastboot oem unlock
again, which will wipe the data.
Have you received the security patch yet for March on your Nexus device? Let us know in the comments!
One Comment
You must log in to post a comment.