Google，你的安全补丁到底告诉了我们什么？Android补丁漏洞大规模实证研究
Hey Google, What Exactly Do Your Security Patches Tell Us? A Large-Scale Empirical Study on Android Patched Vulnerabilities
摘要：
在本文中，我们对从不同数据源收集的2，470个已修补的Android漏洞进行了全面研究，这些数据源包括Android安全公告、CVEDetails、Qualcomm Code Aurora、AOSP Git存储库和Linux Patchwork。在我们的数据分析中，我们专注于确定受影响的层、操作系统版本、严重性级别以及与修补漏洞相关的常见弱点枚举（CWE）。此外，我们评估每个漏洞的时间轴，包括发现和修补日期。我们发现，（i）尽管修补漏洞的数量每月变化很大，但每个严重级别的修补漏洞的相对数量随着时间的推移保持稳定，（ii）修补来自Linux社区或涉及高通组件的漏洞存在显著延迟，即使Linux和高通提供并发布自己的补丁，（iii）不同的AOSP版本在不同的时间段内接收安全更新，（iv）对于94%的已修补Android漏洞，在公共数据集中披露的日期不在补丁发布日期之前，（v）公共漏洞数据源之间存在一些不一致之处，例如，一些CVE ID在Android安全公告中列出了详细信息，但在CVE详细信息中，它们被列为未知，（vi）新Android版本的许多修补漏洞可能也会影响由于生命周期结束而未收到安全补丁的旧版本。
英文摘要：
In this paper, we perform a comprehensive study of 2,470 patched Android vulnerabilities that we collect from different data sources such as Android security bulletins, CVEDetails, Qualcomm Code Aurora, AOSP Git repository, and Linux Patchwork. In our data analysis, we focus on determining the affected layers, OS versions, severity levels, and common weakness enumerations (CWE) associated with the patched vulnerabilities. Further, we assess the timeline of each vulnerability, including discovery and patch dates. We find that (i) even though the number of patched vulnerabilities changes considerably from month to month, the relative number of patched vulnerabilities for each severity level remains stable over time, (ii) there is a significant delay in patching vulnerabilities that originate from the Linux community or concern Qualcomm components, even though Linux and Qualcomm provide and release their own patches earlier, (iii) different AOSP versions receive security updates for different periods of time, (iv) for 94% of patched Android vulnerabilities, the date of disclosure in public datasets is not before the patch release date, (v) there exist some inconsistencies among public vulnerability data sources, e.g., some CVE IDs are listed in Android Security bulletins with detailed information, but in CVEDetails they are listed as unknown, (vi) many patched vulnerabilities for newer Android versions likely also affect older versions that do not receive security patches due to end-of-life.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
