It's a new month, and that means a new security update for Android. The November Android security patch is out, and this is more noteworthy than most with its fix for the high-profile key reinstallation attack (KRACK). It also puts some Band-Aids on the newly released Pixel 2 phones.

Google actually released three "November" security patches last night. First there's the normal "2017-11-01" security patch, which contains all the monthly patches developed on the regular schedule. OEMs get these fixes a full month in advance (so early October in this case), and Google lets the bugs sit around for a whole month, allowing OEMs to port the patch to their phones. A month later, Google discloses the bugs and (theoretically) does a simultaneous release with the Android OEMs and carriers.

Anything higher than the "20xx-xx-01" release exists because Google needed to target a particularly nasty bug in the middle of the month and fast track it through the release system. In this case, we have the "2017-11-05" and "2017-11-06" releases. While the 11/5 patch was mostly about fixing a critical Qualcomm bug, it's the 11/6 patch that will get the most attention, since it patches the KRACK Wi-Fi vulnerability.

Correction: Any bulletin dated the 1st of the month covers AOSP bugs, while patches dated the 5th of the month cover hardware vendor specific bugs. Both of these are part of Google's normal patch cycle and happen every month. Anything higher than the 5th of the month (usually labeled the 6th) is an out-of-cycle patch. We have much more detail here.

In mid-October, a weakness in the WPA2 Protocol was found, which handles security for most Wi-Fi networks. Researchers found that a key reinstallation attack (KRACK) could disrupt the initial encryption handshake that takes place between an access point and a device, allowing an attacker to read information that was assumed to be encrypted. Any device that uses Wi-Fi is most likely vulnerable, but Linux and Android 6.0+ devices are particularly vulnerable, since they can be tricked into installing an all-zero encryption key.

In response Google patched a slew of bugs related to KRACK under the "2017-11-06" label. The versions patched cover Android 8.0 Oreo all the way back to Android 5.0.2 Lollipop, which Google still supports under the three-year security patch window. I'm not sure any OEM out there will actually patch an Android 5.0 device, but it's nice that Google cares.

The later November patches haven't been given to OEMs as early as the 11/01 patch, so don't be surprised if your OEM doesn't have a patch out yet. In this case, Google says, "Android partners were notified of all issues in the 2017-11-01 and 2017-11-05 patch levels at least a month before publication," (emphasis ours) while details about the 11/6 patch only went out "within the last month." Google is disclosing the bugs now, although the Android Open Source Project (AOSP) repository will have the code in the next 48 hours, and Google's Pixel and Nexus devices will no doubt be rolling out soon.

All of these patch dates correspond to the "Android Security Patch Level" on a device's "about" screen. Just because you have a "November" security patch doesn't mean you have all the November security patches. The magic string to look for this month is "2017-11-06," which means you have the KRACK fix and also all the patches that came before it.

Update: Google's Pixel and Nexus patches and security bulletin actually only claim the "2017-11-05" patch level for now, meaning they don't have the KRACK fix. I guess the 11/6 patch will be rolling out eventually? I reached out to Google for clarification. The bulletin claims the KRACK fix will be in AOSP within 48 hours, so a Pixel patch shouldn't be too far behind. Google's patch roll out process takes a full month anyway, so a day or two delay shouldn't make much difference.

Update 2: A KRACK patch for the Pixel and Nexus devices will come out in December.

Addressing Pixel 2 user complaints





It also seems like Google is expanding the monthly security update program for the Pixel phones to formally include non-security fixes. A new section on the "Pixel/Nexus Bulletins" page is called "Functional updates" and lists a bunch of bug fixes in addition to the slew of security fixes. There are 12 non-security bugs that have been officially squashed this month, mostly having to do with Bluetooth.

The November patch also includes most of the Pixel 2 and Pixel 2 XL fixes Google announced two weeks ago. The Pixel 2 XL (but not the Pixel 2) is one of the first phones in recent memory to launch with an LG-made OLED display, and the results were not great. The display had a slew of issues and has been widely criticized online. In response to user complaints, Google promised a number of changes.

To address complaints of burn in, Google said it would lower the maximum brightness by a "virtually imperceptible 50 cd/m2 (nits)," which it said would reduce load on the screen. It changed the biggest burn-in culprit, the always-on navigation bar, to dim when it wasn't being used and make it switch from black to white in certain apps. The November security patch lowers the max brightness and includes a dimming navigation bar, but it doesn't switch to white yet. To see what the white navigation bar looks like, you can check out the Android 8.1 Developer Preview.

Another complaint was a claim that the colors of the display were "dull." This is mostly a learned preference thanks to Samsung and other OEMs shipping oversaturated displays for years, while the Pixel 2 adheres closer to the sRGB color spec. Google thought of this before the Pixel 2 launched and included a "vivid color" checkbox in the display settings, but this still wasn't enough for some users. So as of the November security patch, there's a new "colors" section in the display settings with three saturation options: "Natural," "Saturated," and "Boosted." "Saturated" is the new super saturated mode, which ignores sRGB and stretches the colors out to the display's maximum, just like a Samsung phone.

Some Pixel 2 and 2 XL owners were also experiencing odd clicking noises coming from the speaker during a call. Google says that problem has been fixed in the November patch, too.