Post

First an important point: we only research open source code, which means that many parts of your phone (for example most of your apps) are out-of-scope for us. That said, all open source code is in-scope, including projects that aren’t hosted on GitHub.

developer.arm.comMali Drivers | Open Source Valhall Mali 4th Gen GPU Architecture Kernel Drivers – Arm DeveloperThe Android and Linux version of the Mali GPUs Device Driver provide low-level access to the Mali GPUs that are part of the Valhall family. Some of these components are being made available under the ...

In this particular case, Man Yue Mo found a bug in Arm Mali, which is an open source GPU driver used on many Android phones. Android itself is open source. developer.arm.com/downloads/-/...

Open source software is the foundation of much of the world’s software. So when open source wins, we win. And that’s why @github.com takes its responsibility seriously, to help make open source software more secure.

GitHub Security Lab sits within GitHub Security, and we focus exclusively on open source security with four main priorities:

github.comGitHub Advisory DatabaseA database of software vulnerabilities, using data from maintainer-submitted advisories and from other vulnerability databases.

First, we run the GitHub Advisory Database, which is a comprehensive database of open source vulnerabilities. github.com/advisories

github.blogBuild code security skills with the GitHub Secure Code GameLearn to find and fix security issues while having fun with Secure Code Game, now with new challenges focusing on JavaScript, Python, Go, and GitHub Actions!

Second, we share information around secure coding practices, through blogs and video content. github.blog/developer-sk...

gh.ioCodeQL Wall of FameSecuring open source software, together.

Third, we use GitHub’s CodeQL to scan thousands of open source repositories for common security mistakes, like SQL injections or path traversals. gh.io/codeql-wall-of-fame

github.blogGaining kernel code execution on an MTE-enabled Pixel 8In this post, I’ll look at CVE-2023-6241, a vulnerability in the Arm Mali GPU that allows a malicious app to gain arbitrary kernel code execution and root on an Android phone. I’ll show how this vulne...

And fourth, we do deep research on critical open source projects. Man Yue Mo's work on Arm Mail is an example of this. github.blog/security/vul...

docs.github.comAbout Dependabot alerts - GitHub DocsGitHub sends Dependabot alerts when we detect that your repository uses a vulnerable dependency.

The work that we do feeds into GitHub’s security products. For example, the advisory database is used to generate Dependabot alerts. docs.github.com/en/code-secu...

docs.github.comAbout code scanning - GitHub DocsYou can use code scanning to find security vulnerabilities and errors in the code for your project on GitHub.

Similarly, our work with CodeQL provides feedback to the code scanning team to help improve and further develop the feature so that more vulnerabilities are caught quickly and automatically. docs.github.com/en/code-secu...

And these activities also benefit open source, because GitHub security products, including Dependabot and CodeQL, are free for open source projects!

github.comsecuritylab/SecurityExploits/Android/Mali/CVE_2023_6241 at main · github/securitylabResources related to GitHub Security Lab. Contribute to github/securitylab development by creating an account on GitHub.

Our deep research work is primarily intended to inspire the community, so that we can improve open source security together. That’s why we publish detailed blog posts and proof-of-concept exploits. github.com/github/secur...

6/2/25, 9:59 pm0 reposts0 likes