I think that's the one that made a lot of OEMs pull back on opensource publishing, because their legal departments want to batch the CVE monitoring and reporting obligations into smaller batches.
Also, major Android releases and QPR2s have many security fixes (anything not marked high/critical), yet OEMs are not rolling them out (QPR2) or very late (major releases).
Just to say that OEMs were probably violating the act already before Google started withholding source code.
I also think it’s an attempt of Google closing up AOSP more, otherwise they wouldn’t make it so darn hard to get updated Pixel kernel trees.
withholding security updates seems to avoid a law which requires rolling out security updates seems very much like something which needs to be fixed one way or another
Also - the reality of what you think is ok and what a corporate legal department think its ok is... rarely the same -_-
Then there is no time limit to provide a mitigation. It should just be worked out without unnecessary delays. Once a mitigation is published, a report should be submitted with 14 days.
Regulators present an impossible goal to the companies to implement, instead of implementing the goal, the companies try to reward hack their way around it.
The end result is that they basically try to make it impossible to know about vulnerabilities because that would start the clock.
But many Android OEMs are probably terrible at software engineering and have their attention spread across multiple SoCs, etc. It’s their own fault.
What does "timely" here mean? A lot of security patches for all these companies take ~weeks+ to actually make it to customers due to things like QA testing, carrier testing and release processes.
The time between disclosure and release can be rather long, months even for all of them. (I'm counting private disclosure here.)
Google has an embargo period of up to 6 months on AOSP patches. This is why GrapheneOS already has April 2027 AOSP security patches now. Even though some patches are already known for 6 months, they still manage to ship it 1-3 months late. 7-9 months after they got the patches already from Google.
due to things like QA testing, carrier testing and release processes.
Carrier testing is mostly a US thing. If you cannot roll out security patches within a few days, your QA and release processes are just totally broken. GrapheneOS can do it and they generally have far fewer regressions than Android OEMs.
Major releases and QPR2 take some time for testing, but they already have the access to sources months before they are released. Heck, Samsung releases major release betas and QPR2 betas quite a while before Google releases it as stable.
The problem is that the OEMs made a mess. First they just dropped phones on the market without doing any updates at all. Mid 2010s it was very normal for an OEM to do maybe one or two updates. Then Google had to push them to do better, among other reasons because Apple does much better and there were really big fails like Stagefright. Plus users wanted new Android releases. Then they did only 2-3 updates with very irregular software updates. Now they are under pressure from EU regulations and they actually have to support devices for a long time and do regular updates, but they just don't have good release processes. Plus they made their own 'skins' on top of it that they have to rebase, etc.
Companies that have their ducks in a row better, abuse the release process to push sales of new devices. E.g. Samsung withholds major/QPR releases for a while so that only their latest device have it, e.g. recently Fold 8/Flip 8.
People should stop beingapologists for multi-billion dollar companies.
That's the reality - yes, even for Apple.
If you think they could and should be better - I guess I agree, but it doesn't change the reality.
> an early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it
> without undue delay and in any event within 72 hours of the manufacturer becoming aware of the actively
> without undue delay and in any event within 24 hours of the manufacturer becoming aware of it
> without undue delay and in any event within 72 hours of the manufacturer becoming aware of the incident
"Sorry your honour, we only became 'aware of it' 2 years later, pinky promise ;)".
So any competant authority would have to prove when they 'became aware of it', whatever the test to pass that threshold means.
“Please stop using this version of my product or this particular feature; it is vulnerable” is an acceptable mitigation measure.
A CVE isn't an active exploitation and don't trigger anything.
As long as they start the process and it is not absurd from an industry standards perspective, they should be good. They can have slow processes, including being a good bit slower than their peers, without running afoul of "without undue delay".
Well, the corporate lawyers think otherwise at those corporations, so I'm not sure how much your interpretation counts :)
Maybe the misunderstanding stems from the related common misuse of "as soon as possible" as "immediately"?
A corporate lawyer would, however, always suggest to minimize/reduce/delay any legal obligations so as to minimize risk of liability, regardless of whether said obligation is easy to comply with or not.
Security flaws are discovered almost every day (now that they are automating it with AI there are a ton of reports), pretending the manufacturer releases an update in 1 day is nonsense.
Just building the code alone it would take a lot of time, and of course you have to test it at least a bit before giving it out to the end users, you can't pretend to rollout on a global scale a nightly build without first at least some level of QA risking bricking user devices.
And you have to consider that phone manufacturer doesn't work h24 and 7/7 of course to give out patches.
I think that we are fortunate if the whole process takes less than a month, not a day.
> The CRA requires manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of their product with digital elements. They need to submit an early warning within 24 hours of becoming aware, and a full notification within 72 hours.
These deadlines are entirely unrelated to the availability of security fixes and delays in deliverying them.
The part that’s probably bothering Google is this:
> 6. Manufacturers shall, upon identifying a vulnerability in a component, including in an open source-component, which is integrated in the product with digital elements report the vulnerability to the person or entity manufacturing or maintaining the component, and address and remediate the vulnerability in accordance with the vulnerability handling requirements set out in Part II of Annex I. Where manufacturers have developed a software or hardware modification to address the vulnerability in that component, they shall share the relevant code or documentation with the person or entity manufacturing or maintaining the component, where appropriate in a machine-readable format.
To put it very simply, the CRA calls on all stakeholders to cooperate in reporting incidents and vulnerabilities, establishes a national coordination mechanism, and aims to address vulnerabilities swiftly in order to maintain essential services within the European Union.