[OnePlus 2 Original Android Development] anupritaisno1:
Updated:

Security changes from march ASB:

Implemented:

============

CVE: References: Type: Severity: Updated AOSP versions:

CVE-2018-9561 A-111660010 ID High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2018-9563 A-114237888 ID High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2018-9564 A-114238578 ID High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2018-20346 A-121156452 EoP High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-1989 A-118399205 RCE Critical 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-1990 A-118453553 RCE Critical 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-2003 A-116321860 EoP High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-2004 A-115739809 ID High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-2005 A-68777217 EoP Moderate 8.0, 8.1, 9

CVE-2019-2007 A-120789744 EoP High 8.1, 9

CVE-2019-2008 A-122309228 EoP High 8.0, 8.1, 9

CVE-2019-2009 A-120665616 RCE Critical 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-2010 A-118152591 EoP High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-2011 A-120084106 EoP High 8.0, 8.1, 9

CVE-2019-2012 A-120497437 EoP High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-2013 A-120497583 EoP High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-2014 A-120499324 EoP High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-2015 A-120503926 EoP High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-2016 A-120664978 EoP High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-2017 A-121035711 EoP High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-2018 A-110172241 EoP High 8.1, 9

CVE-2019-2019 A-115635871 ID High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-2020 A-116788646 ID High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-2021 A-120428041 ID High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-2022 A-120506143 ID High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-2023 A-121035042 EoP High 8.0, 8.1, 9

Not Implemented:

================

None

Not Applicable (platform source):

===============

CVE: References: Type: Severity: Updated AOSP versions:

CVE-2019-1985 A-118694079 EoP High 7.0, 7.1.1, 7.1.2, 8.0

CVE-2019-2006 A-116665972 EoP High 9

https://github.com/GlassROM/android_build/commit/822c751d90c9a796b882ee191be3c8000e1f3aff

Kernel CVEs:

Fixed:

CVE-2018-10883 https://github.com/GlassROM-devices...mmit/e703c792f33381f45ea892d2b67f03c2053c8998

Does not apply:

CVE-2019-2024

Not fixed:

CVE-2019-2025 (reason: additional backports are required but I was unable to backport the changes. This will likely remain vulnerable. I'm sorry about that)

February ASB changes:

Implemented:

============

CVE: References: Type: Severity: Updated AOSP versions:

CVE-2019-1987 A-118143775 RCE Critical 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-1988 A-118372692 RCE Critical 8.0, 8.1, 9

CVE-2019-1991 A-110166268 RCE Critical 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-1992 A-116222069 RCE Critical 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-1993 A-119819889 EoP High 8.0, 8.1, 9

CVE-2019-1994 A-117770924 EoP High 8.0, 8.1, 9

CVE-2019-1995 A-32589229 ID High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

CVE-2019-1996 A-111451066 ID High 8.0, 8.1, 9

CVE-2019-1997 A-117508900 ID High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9

Not Implemented:

================

None

Not Applicable (platform source):

===============

CVE: References: Type: Severity: Updated AOSP versions:

CVE-2017-17760 A-78029030 RCE High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 (opencv 3.3.1)

CVE-2017-18009 A-78026242 ID Moderate 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 (opencv 3.3.1)

CVE-2018-5268 A-78029634 RCE High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 (opencv 3.3.1)

CVE-2018-5269 A-78029727 RCE High 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 (opencv 3.3.1)

CVE-2019-1986 A-117838472 RCE Critical 9

CVE-2019-1998 A-116055338 DoS High 9

https://github.com/GlassROM/android_build/commit/d699eb9b2d47c1efafadc8dd8eabc2407024635c

Kernel CVEs:

Fixed:

CVE-2018-10879 https://github.com/GlassROM-devices...mmit/f679215a584e3806f1b4112e8e53343cf609f903

CVE-2019-1999 https://github.com/GlassROM-devices...mmit/79cbb3a975f7298c058416b5253c73fd0761533f

CVE-2019-2000 https://github.com/GlassROM-devices...mmit/79cbb3a975f7298c058416b5253c73fd0761533f

CVE-2019-2001 https://github.com/GlassROM-devices...mmit/65faf578870865a9944b7005c1f35b1a062a724f

Does not apply:

None

Not fixed:

None

The following critical CVEs not present in the ASB were fixed: CVE-2019-8912 https://github.com/GlassROM-devices...mmit/1ae29b00bcdea59de6a4fb10dcf4a8919be38881

Additional details: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8912

https://security-tracker.debian.org/tracker/CVE-2019-8912

https://cloudlinux.com/cloudlinux-os-blog/entry/cve

Many CVEs not present in the ASB were also fixed. Please refer to github for details

Fixed a terrible bug that caused volume buttons and alert slider to not work

Fixed a bug where using lockscreen gestures would lead to a system UI crash

Fixed a bug where playing music would randomly make the device soft reboot

Fixed a bug where device would randomly reboot to rescue party

Encryption now formats data instead of using in-place encryption. This fixes a bug where device would not boot if the correct space for encryption (16384 bytes) was not reserved at the end of the data partition

Dm-verity is now enforced. Tick mount system partition read-only in TWRP before flashing or use a dm-verity disabler

Verifying builds: https://github.com/GlassROM/glassrom-verification/commit/d18c5f409557674d8a102d13bb5f0e612a2b5f42