Serious Security Bugs Found In Android Kernel
[](http://1.bp.blogspot.com/_A8fllzIwp8c/TNLCd6RBtoI/AAAAAAAAAOg/TXJN4zBnT4Y/s1600/android-logo.png)
Security analysts at [Coverity](http://www.coverity.com/) reckon the [Android](http://www.android.com/) kernel is riddled with security holes, though they still rate it as twice as good as most open-source projects.
Taking the source code from the HTC Incredible, [Coverity](http://www.coverity.com/) found .47 defects per 1,000 lines of code, compared with an industry average of 1 per 1,000. That totalled 359 defects, with 88 of those being high-risk
items such as memory corruption, memory leaks and uninitialised variables. But [Coverity](http://www.coverity.com/) won’t be providing any details until the end of the year.
The company discovered the flaws though automated analysis of the source code, and will, in the name of responsible disclosure, provide early access to “the [Android](http://www.android.com/) security team, OEMs, and security researchers” so they can apply fixes, or create proof-of-concept attacks, before the details go public in 60 days.
Until then, we’re left to speculate what proportion of those bugs exist across [Android](http://www.android.com/) kernel implementations – and how many could be usefully exploited for fun and profit. Manufacturers tweak the Android kernel to suit their hardware. The team only picked the HTC Incredible because they happened to have one handy, but the commonality of chip sets in [Android](http://www.android.com/) handsets makes it likely the majority of flaws are common too.
Exploiting those flaws is another matter entirely. One can imagine a stack overflow allowing an application to break out of the sandbox security, but such an application would likely be quickly identified and (if distributed via the Marketplace) subsequently removed. It’s possible that more-easily-exploited flaws exist too, but hopefully they’ll be fixed before [Coverity](http://www.coverity.com/) goes public.
[Coverity](http://www.coverity.com/) said it will hold off releasing the details of the flaws until January to allow [Google](http://www.google.com/) and handset vendors to issue fixes. The flaws could be patched via an over-the-air update, [Coverity](http://www.coverity.com/) said.
Being open to scrutiny is one of the advantages of being open source, so this is no reason to trust your [Android](http://www.android.com/) handset any less, and if you fancy yourself as a security researcher then [drop Coverity a line](http://blog.coverity.com/open-source/launch-of-the-coverity-scan-2010-open-source-integrity-report/) to get more details.