Nexus devices to get monthly security update to patch critical Linux kernel vulnerability

Google will release a monthly security update to address a security flaw discovered in the rooting applications that uses a vulnerability in the kernel on some of the Android devices. Google has already provided its partners with a patch for the issues recently. Besides, the source code patches for the issue have been released to the Android Open Source Project (AOSP) repository.

Google has blocked the installation of rooting apps with the vulnerability within Google Play and outside of it, through Verify apps. It has also updated its system to detect the apps that use this vulnerability.

This is a known issue in the Linux kernel and was fixed in 2014. But recently the vulnerability has been found on the Nexus 5 and 6. The security flaw has now been rated as critical, as it could allow attackers to execute arbitrary codes and get access to compromised devices.

"On February 19, 2016, C0RE Team notified Google that the issue could be exploited on Android and a patch was developed to be included in an upcoming regularly scheduled monthly update," reads a release note about Android Security Advisory on the Android website. "On March 15, 2016 Google received a report from Zimperium that this vulnerability had been abused on a Nexus 5 device. Google has confirmed the existence of a publicly available rooting application that abuses this vulnerability on Nexus 5 and Nexus 6 to provide the device user with root privileges."

The exploit works on the Nexus 5 and 6, but all unpatched Android devices on kernel versions 3.4, 3.10 and 3.14 are vulnerable. The devices using kernel version 3.18 or higher are not vulnerable. Users are advised to download and install the update on their devices once they become available.