In a significant advancement for Android security, the introduction of the new AndroidX Security State libraries marks a pivotal shift in how developers assess the security status of devices. The stable releases of Security State v1.1.0 and Security State Provider v1.0.0 empower developers with the ability to evaluate the security status of individual components within a device, facilitating a more nuanced understanding of security updates that are available for download and installation.
Three levels of security patch information
As the Android ecosystem continues to evolve, the need for a more sophisticated approach to security assessments has become evident. Google engineers have articulated that the traditional reliance on a single Security Patch Level (SPL) build property is no longer sufficient to gauge a device’s comprehensive security posture. Instead, the newly introduced Security State libraries offer developers the capability to monitor three distinct patch levels:
- Device Security Patch Level (DSPL): This indicates the current patches that are installed and actively running on the device.
- Published Security Patch Level (PSPL): This reflects the latest patches that the manufacturer has officially released, as documented in the Android Security Bulletin.
- Available Security Patch Level (ASPL): This reveals the updates that are available for the specific device to download and install.
The checks encompass critical components of the Android operating system, including system modules that receive updates via Google Play system updates, as well as the Linux kernel. Notably, kernel security levels are represented by version numbers, such as 5.15.159 or 6.1.91, rather than the conventional monthly security patch dates.
CVE-level security checks
This enhanced granularity in security information is particularly beneficial for applications that prioritize security, such as banking or enterprise apps. These applications can leverage the detailed patch information to make informed decisions regarding high-value transactions or credential enrollments. For instance, developers can verify whether critical vulnerabilities, tracked as Common Vulnerabilities and Exposures (CVEs), have been addressed before activating features like tap-to-pay or proximity-based data sharing.
The libraries also integrate seamlessly with the Open Source Vulnerabilities (OSV) database, enabling access to Android Security Bulletin data and facilitating the download of device-specific vulnerability reports for CVE-level auditing. This integration provides a comprehensive view of a device’s security state, enhancing the overall security framework.
Moreover, Android 17 introduces the capability for manufacturers to declare individual security fixes that extend beyond the device’s stated security patch level, including backported fixes for older software. Currently, Google Play system updates are equipped to provide ASPL information for Android devices utilizing Google Mobile Services (GMS), while Google Over-The-Air (GOTA) has also embraced this standardized framework. Google is actively collaborating with device manufacturers to transition their OTA update clients to this new, standardized system, further solidifying the security landscape for Android users.
