Vulnerability, Where Art Thou? An Investigation of Vulnerability Management in Android Smartphone Chipsets

Daniel Klischies,Philipp Mackensen,Veelasha Moonsamy

DOI: https://doi.org/10.14722/ndss.2025.241161

2024-12-09

Abstract:Vulnerabilities in Android smartphone chipsets have severe consequences, as recent real-world attacks have demonstrated that adversaries can leverage vulnerabilities to execute arbitrary code or exfiltrate confidential information. Despite the far-reaching impact of such attacks, the lifecycle of chipset vulnerabilities has yet to be investigated, with existing papers primarily investigating vulnerabilities in the Android operating system. This paper provides a comprehensive and empirical study of the current state of smartphone chipset vulnerability management within the Android ecosystem. For the first time, we create a unified knowledge base of 3,676 chipset vulnerabilities affecting 437 chipset models from all four major chipset manufacturers, combined with 6,866 smartphone models. Our analysis revealed that the same vulnerabilities are often included in multiple generations of chipsets, providing novel empirical evidence that vulnerabilities are inherited through multiple chipset generations. Furthermore, we demonstrate that the commonly accepted 90-day responsible vulnerability disclosure period is seldom adhered to. We find that a single vulnerability often affects hundreds to thousands of different smartphone models, for which update availability is, as we show, often unclear or heavily delayed. Leveraging the new insights gained from our empirical analysis, we recommend several changes that chipset manufacturers can implement to improve the security posture of their products. At the same time, our knowledge base enables academic researchers to conduct more representative evaluations of smartphone chipsets, accurately assess the impact of vulnerabilities they discover, and identify avenues for future research.

Cryptography and Security

What problem does this paper attempt to address?

This paper attempts to address the vulnerability management issues in smartphone chipset, especially in the Android ecosystem. Specifically, the author aims to fill the gaps in existing research and provide a comprehensive and empirical analysis of the vulnerability life cycle of smartphone chipset. The following are the main problems that this paper attempts to solve:

1. **Lack of research on the chipset vulnerability life cycle**:
- Existing literature mainly focuses on the vulnerabilities of the Android operating system while ignoring the research on chipset vulnerabilities. Although chipset vulnerabilities may affect multiple device generations and have serious security consequences, their life cycle has not been fully studied.

2. **Vulnerability spread and inheritability**:
- The author found that some chipset vulnerabilities are prevalent across multiple generations, which means that newly released chipset may inherit vulnerabilities from previous versions. This phenomenon requires further empirical evidence to support.

3. **Compliance with the responsible disclosure period**:
- According to industry practice, a 90 - day responsible disclosure period is generally considered reasonable. However, the author found that this period is rarely strictly adhered to, resulting in many devices remaining at risk after the vulnerabilities are made public.

4. **Update availability and delay**:
- Many chipset vulnerabilities affect hundreds or thousands of different smartphone models, but the update availability for these devices is often unclear or severely delayed. This indicates that the existing vulnerability management and update processes are insufficient.

5. **Suggestions for improving transparency and security**:
- Based on the above findings, the author proposes several improvement suggestions to help chipset manufacturers improve the security of their products, enable academic researchers to conduct more representative assessments, accurately assess the impact of newly discovered vulnerabilities, and point out directions for future research.

### Main contributions
- **Create a unified knowledge base**: For the first time, the author created a comprehensive knowledge base containing 3,676 chipset vulnerabilities, involving 437 chipset models and 6,866 smartphone models.
- **Empirical analysis**: Through a large - scale data set, the author answered research questions (RQ1 - RQ4) regarding vulnerability origin, discoverer, patch availability, and update process.
- **Cross - ecosystem comparison**: Compare the findings with similar studies to reveal the factors affecting the vulnerability life cycle.
- **Propose improvement suggestions**: Based on the results, the author discussed specific measures that various stakeholders can implement to improve device security and transparency.
- **Enrich future research**: Describe how the new knowledge base can be used to enhance future experimental evaluations, provide a more accurate portrayal of vulnerability impact, and reveal promising research directions.

### Conclusion
Through systematic analysis and empirical research, this paper reveals the problems existing in the Android smartphone chipset vulnerability management and provides improvement suggestions, thus laying the foundation for improving the security of the entire ecosystem.