Serbian student activist’s phone hacked using Cellebrite zero-day exploit
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-50302 | Kernel Memory Leak via Uninitialized HID Report Buffer in Linux Kernel CVE-2024-50302 is a use of uninitialized resource flaw (CWE-908) in the Linux kernel's HID (Human Interface Device) core, where the shared report buffer was not zero-initialized at allocation. An attacker can trigger it by getting the kernel to process a specially crafted HID report, causing uninitialized kernel memory to be exposed to the requesting driver. The impact is an information disclosure: a local attacker, or a malicious/malfunctioning HID device, could leak kernel memory contents, which could in turn aid further attacks. Because nearly all Linux-based systems compile in HID support, affected code is present in Linux distributions, Android, and Siemens industrial products (SIMATIC S7-1500 TM MFP firmware and SINEC OS). The vulnerability is being actively exploited: CISA added it to the KEV catalog on 2025-03-04, and it is among the actively exploited flaws addressed in Google's March 2025 Android security update. Do: Apply the fixes per vendor channels: install the March 2025 Android security update on Android devices (it is listed as actively exploited and is in CISA KEV, required under BOD 22-01 for federal agencies), and apply Debian kernel updates and Siemens (SIMATIC S7-1500 TM MFP firmware / SINEC OS) updates once issued. Operators should inventory systems running Linux kernels with the HID core (most systems) and prioritize patching, since a local attacker or malicious USB HID device can leak kernel memory; the fix zero-initializes the HID report buffer and is included in current stable kernel branches. | 5.5 | <1% | KEV |
| massBillions of devices ship affected Linux kernel HID code (Linux runs on ~3+ billion Android devices plus millions of servers, desktops, and industrial systems),… | |
| CVE-2024-53104 | Out-of-Bounds Write in Linux Kernel UVC Video Driver (CVE-2024-53104) CVE-2024-53104 is an out-of-bounds write (CWE-787) in the Linux kernel's uvcvideo (USB Video Class) driver: uvc_parse_format does not skip frames of type UVC_VS_UNDEFINED, but those frame types were not accounted for when sizing the frames buffer in uvc_parse_streaming. The flaw is triggered when the kernel parses format/frame descriptors from a USB camera device, so a crafted or nonconforming USB video descriptor can corrupt adjacent kernel memory. An attacker with local, low-privileged access (CVSS 3.1: AV:L/AC:L/PR:L, 7.8 High) can gain kernel memory corruption with high impact to confidentiality, integrity and availability, typically yielding local privilege escalation. Any Linux system or Android device running a kernel that ships the UVC driver is in scope, including Debian and other distributions built from affected kernel sources. Exploitation is confirmed in the wild: the vulnerability was added to CISA's KEV on 2025-02-05, Google fixed it as an actively exploited flaw in the March 2025 Android Security Update, and EPSS currently estimates a 3.4% (88th percentile) probability of exploitation over the next 30 days. Do: Upgrade to a Linux kernel version that contains the uvcvideo fix (apply updated kernel packages from your distribution, e.g. Debian), and for Android devices install the March 2025 Android Security Bulletin patches or later. Follow the CISA KEV required action by applying vendor mitigations or discontinuing use if patches are unavailable. To gauge exposure on unpatched hosts, check whether the UVC driver is loaded (e.g. 'lsmod | grep uvcvideo') and restrict untrusted USB video devices until patched. | 7.8 | 3% | KEV |
| masshundreds of millions of Linux/Android installations potentially carrying the vulnerable driver (Linux kernel runs on billions of devices and the UVC driver… | |
| CVE-2024-53197 | Out-of-Bounds Write in Linux Kernel ALSA USB Audio Driver (CVE-2024-53197) CVE-2024-53197 is an out-of-bounds access/write (CWE-787) in the Linux kernel's USB configuration handling, tied to the ALSA usb-audio driver's handling of Creative Extigy and Mbox devices. A malicious or bogus USB device that reports a bNumConfigurations value larger than the array allocated by usb_get_configuration causes the kernel to access memory beyond the end of dev->config, for example in usb_destroy_configuration. An attacker with local access — or the ability to plug a crafted USB audio device into a target — could corrupt or disclose kernel memory, with high impact to confidentiality, integrity, and availability (CVSS 7.8, local vector), typically as privilege escalation or a kernel crash. Any Linux deployment running a kernel with the vulnerable code is affected, including Debian systems. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-04-09, indicating known exploitation in the wild, though no public proof-of-concept is known and ransomware use is unconfirmed. Do: Update the Linux kernel to a vendor release containing the CVE-2024-53197 fix — for Debian, install the current kernel security update and reboot; other distributions ship the patched kernel in their stable updates. Because exploitation requires a malicious USB audio device, restrict use of untrusted USB peripherals on sensitive or internet-adjacent hosts. Organizations subject to CISA BOD 22-01 must remediate this KEV-listed flaw per the required actions or discontinue use where mitigations are unavailable. | 7.8 | 4% | KEV |
| massmillions of Linux installations (kernel ubiquity across desktops, servers, and Debian; practically reachable only on hosts that accept untrusted USB audio… |
Full article1,131 words · extracted from securityaffairs.com · click to collapse
Amnesty International reports that a Cellebrite zero-day exploit was used to unlock a Serbian activist’s Android phone.
Amnesty International reported that a Cellebrite zero-day exploit was used to unlock the Android smartphone of a Serbian activist.
In a statement published on 25 February 2025, Cellebrite announced that it had blocked Serbia from using its solution after reports that police used it to unlock and infect the phones of a journalist and activist.
“the Android phone of one student protester was exploited and unlocked by a sophisticated zero-day exploit chain targeting Android USB drivers, developed by Cellebrite. Amnesty International first found traces of this Cellebrite USB exploit used in a separate case in mid-2024.” reads the report published by Amnesty International. “Since the exploits identified in this research target core Linux kernel USB drivers, the vulnerability is not limited to a particular device or vendor and could impact over a billion Android devices.”
In 2024, the Security Lab provided evidence of a Cellebrite zero-day exploit chain to industry partners, leading Google to identify three vulnerabilities. CVE-2024-53104 was patched in Android’s February 2025 update, while CVE-2024-53197 and CVE-2024-50302 (CVSS score of 5.5) were patched in the Linux kernel but not yet in Android.
The vulnerability CVE-2024-53104 (CVSS score: 7.8) is a privilege escalation security flaw in the Kernel’s USB Video Class driver. An authenticated local attacker could exploit the flaw to elevate privileges in low-complexity attacks.
The issue stems from improper parsing of UVC_VS_UNDEFINED frames, causing miscalculation of the frame buffer size and potentially leading to arbitrary code execution or denial-of-service attacks.
“In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.” reads the advisory.
Cellebrite’s exploit targeted Linux kernel USB drivers, allowing users to bypass Android lock screens with physical access. It could affect many devices, including Linux computers and embedded systems, though no evidence suggests non-Android targets.
“The exploit, which targeted Linux kernel USB drivers, enabled Cellebrite customers with physical access to a locked Android device to bypass an Android phone’s lock screen and gain privileged access on the device. As the exploit targets core Linux kernel USB drivers, the impact is not limited to a particular device or vendor and could affect a very wide range of devices. The same vulnerabilities could also expose Linux computers and Linux-powered embedded devices to physical attacks, although there is no evidence of this exploit chain has been designed to target non-Android Linux devices.” continues Amnesty. Android vendors must urgently strengthen defensive security features to mitigate threats from untrusted USB connections to locked devices.”
Amnesty International said that a 23-year-old student activist (named Vedran to preserve his privacy) was attending a ruling party event in Serbia on December 25, 2024. Upon arrival, he was forcibly taken by seven plainclothes men, interrogated for six hours at a Belgrade police station, and pressured to unlock his phone. He refused, but his phone was taken and later returned switched off at 12:45 AM. Amnesty International documented the incident.
The forensics analysis conducted by Amnesty found that the Serbian police used the Cellbrite’s exploit to unlock Vedran’s Samsung Galaxy A32 and install an unknown Android application likely linked with NoviSpy spyware.
“Amnesty International’s Security Lab performed a forensic analysis on “Vedran’s” Samsung Galaxy A32 to check if the device was tampered with while “Vedran” was detained at the police station. The forensic analysis found clear evidence of exploitation which Amnesty International can confidently attribute to the use of Cellebrite’s UFED product.” continues the report. “The logs also show that the Cellebrite product enabled the authorities to successfully gain privileged root access to the phone and to unlock the device.
| Timestamp (Local Time) | Event |
| 2024-12-25 18:36:10 | “Vedran” turned his phone off. |
| 2024-12-25 20:01:14 | Phone turned on for the first time in police station. |
| 2024-12-25 20:22:13 | Phone turned on again at police station |
| 2024-12-25 20:24:37 | Emulated USB device (consistent with Cellebrite Turbo Link) connected to phone. |
| 2024-12-25 20:28:38 | Forensic traces of successful Cellebrite exploit and achieving code execution as the root user. |
| 2024-12-25 20:30:11 | Additional traces of Cellebrite activity on device. |
| 2024-12-25 20:37:15 | Traces show phone screen unlocked. |
| 2024-12-25 20:37:59 | Phone reboot triggered through Android shell |
Forensic traces of Cellebrite use on the protesters Android device
Amnesty International found evidence that the Serbian authorities attempted to install an unknown Android application after the phone was unlocked with Cellebrite. Due to limited forensic logs, it was not possible to identify the specific Android app the authorities intended to install. However, this attempt to covertly install an Android app after using Cellebrite to unlock it is consistent with the previous cases of NoviSpy spyware infections documented by Amnesty International.”
Earlier this week, the Israeli company Cellebrite announced that it is suspending the provision of its technology to Serbia due to reports of abuse by local police. Below is the statement published by the company.
“After a review of the allegations brought forth by the December 2024 Amnesty International report, Cellebrite took precise steps to investigate each claim in accordance with our ethics and integrity policies. We found it appropriate to stop the use of our products by the relevant customers at this time.” reads the announcement. “We assess countries we do business with – both on an annual and ad-hoc basis due to political and cultural shifts. We regularly track countries and review a multitude of indexes ranging from democratization to human rights to rule of law. Our robust compliance and ethics program is designed so that democratized nations around the globe use our technology ethically and lawfully – all paramount to our mission of accelerating justice, safeguarding communities and helping to save lives. “
“This decision reinforces Amnesty International’s December findings that Serbian police and intelligence routinely misused Cellebrite’s digital forensic equipment outside legally sanctioned processes to target civil society activists and independent journalists critical of the government.” said Donncha Ó Cearbhaill, Head of the Security Lab at Amnesty International.
“Withdrawing licences from customers who misused the equipment for political reasons is a critical first step. Now, Serbian authorities must urgently conduct their own thorough and impartial investigations, hold those responsible to account, provide remedies to victims and establish adequate safeguards to prevent future abuse.”
“Any further exports of surveillance or digital forensics technology to Serbia must be stopped until the authorities have implemented an effective and independent system of control and oversight over any measures that could restrict people’s right to privacy, freedom of expression or peaceful assembly.” added Donncha Ó Cearbhaill.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, spyware)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/174822/breaking-news/serbian-student-activists-phone-hacked-using-cellebrite-zero-day-exploit.html