Android security woes got worse on Thursday, with two separate reports of code defects that put millions of end users at risk.
The first involves the update Google released last week fixing a flaw that allowed attackers to execute malicious code on an estimated 950 million phones with nothing more than a maliciously crafted text message. Seven days later, security researchers are reporting that the patch, which has been in Google's possession since April, is so flawed that attackers can exploit the vulnerability anyway.
"The patch is 4 lines of code and was (presumably) reviewed by Google engineers prior to shipping," Jordan Gruskovnjak and Aaron Portnoy, who are researchers with security firm Exodus Intelligence, wrote in a blog post published Thursday. "The public at large believes the current patch protects them when it in fact does not."
The code-execution vulnerability is the result of a buffer overflow bug in Stagefright, a code library that processes video. Last week's patch, which was submitted by the researcher who discovered the flaw and privately reported it to Google in April, closed some but not all exploits. Specifically, booby-trapped MP4 videos that supplied variables with 64-bit lengths were able to overflow the buffer and feed malicious code into Android memory. Typically, MP4 videos work with 32-bit variable lengths, but the Exodus researchers found rare cases where 64-bit lengths can be used.