Google is upset with Samsung over ‘unnecessary’ changes to Android’s Kernel

Samsung, which is Google’s biggest OEM partner, is naturally also one of the closest partners, but Samsung’s latest moves – including modifying the Android kernel – have seen that partnership on some rocky shores.

This week, Google’s Project Zero, tasked with finding bugs and security exploits, found “unnecessary changes” to Android’s core kernel with Samsung’s mid range Galaxy A50 smartphone.

What does this mean? Read on – the details are a little technical, but worth understanding.

Google’s Jann Horn explains this concern with Samsung’s Android kernel on the Galaxy A50: just about every Android device makes changes to Android’s Linux kernel in order to work properly. In some cases, device-specific changes are important, even necessary. However, it would seem that some of the changes Samsung made created more vulnerabilities.

Horn stated that Samsung’s changes are for creating direct hardware access to the kernel by adding downstream custom drivers. That’s all well and good, but these changes aren’t reviewed by upstream kernel developers.

Not only does this mean that Samsung is “going it alone” when it probably shouldn’t, but it also means these changes don’t go through official sources or channels approved by Google. This result could possible allow for “possible arbitrary code execution” on devices running Android Pie or even Android 10.

An example of this was a bug which was detected on Samsung’s Galaxy A50 which affected Samsung’s PROCA (Process Authenticator) security subsystem. Google first reported this bug to Samsung back in November last year, with Samsung releasing a patch to fix the bug this month.

Horn stated in his post that Google has since tried to “lock down” which processes have access to device drivers in order to prevent these kinds of vulnerabilities. Device-specific kernel changes are a frequent source of vulnerabilities and when companies like Samsung make these changes to the kernel, it negates Google’s work.

Google says that Samsung’s changes were “unnecessary” in the first place. An example of this would be when one of Samsung’s changes was a security measure to restrict an attacker that gained “arbitrary kernel read/write.” Google has said that this seems “futile” and that Samsung’s efforts would have been better spent preventing an attacker from even getting to that point – ouch.

Horn has said that “ideally, all vendors should move towards using, and frequently applying updates from, supported upstream kernels”, instead of going it alone and potentially making further mistakes.

You can read Horn’s full post on Project Zero’s blog site here.