Google Patches 47 Android Security Flaws, Including Actively Exploited CVE-2024
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-45569 | Memory corruption while parsing the ML IE due to invalid frame content. Memory corruption while parsing the ML IE due to invalid frame content. NVD description · AI analysis pending | 9.8 | <1% |
| — | ||
| CVE-2024-53104 | Out-of-Bounds Write in Linux Kernel UVC Video Driver (CVE-2024-53104) CVE-2024-53104 is an out-of-bounds write (CWE-787) in the Linux kernel's uvcvideo (USB Video Class) driver: uvc_parse_format does not skip frames of type UVC_VS_UNDEFINED, but those frame types were not accounted for when sizing the frames buffer in uvc_parse_streaming. The flaw is triggered when the kernel parses format/frame descriptors from a USB camera device, so a crafted or nonconforming USB video descriptor can corrupt adjacent kernel memory. An attacker with local, low-privileged access (CVSS 3.1: AV:L/AC:L/PR:L, 7.8 High) can gain kernel memory corruption with high impact to confidentiality, integrity and availability, typically yielding local privilege escalation. Any Linux system or Android device running a kernel that ships the UVC driver is in scope, including Debian and other distributions built from affected kernel sources. Exploitation is confirmed in the wild: the vulnerability was added to CISA's KEV on 2025-02-05, Google fixed it as an actively exploited flaw in the March 2025 Android Security Update, and EPSS currently estimates a 3.4% (88th percentile) probability of exploitation over the next 30 days. Do: Upgrade to a Linux kernel version that contains the uvcvideo fix (apply updated kernel packages from your distribution, e.g. Debian), and for Android devices install the March 2025 Android Security Bulletin patches or later. Follow the CISA KEV required action by applying vendor mitigations or discontinuing use if patches are unavailable. To gauge exposure on unpatched hosts, check whether the UVC driver is loaded (e.g. 'lsmod | grep uvcvideo') and restrict untrusted USB video devices until patched. | 7.8 | 3% | KEV |
| masshundreds of millions of Linux/Android installations potentially carrying the vulnerable driver (Linux kernel runs on billions of devices and the UVC driver… |
Full article365 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananFeb 04, 2025Vulnerability / Mobile Security
Google has shipped patches to address 47 security flaws in its Android operating system, including one it said has come under active exploitation in the wild.
The vulnerability in question is CVE-2024-53104 (CVSS score: 7.8), which has been described as a case of privilege escalation in a kernel component known as the USB Video Class (UVC) driver.
Successful exploitation of the flaw could lead to physical escalation of privilege, Google said, noting that it's aware that it may be under "limited, targeted exploitation."
While no other technical details have been offered, Linux kernel developer Greg Kroah-Hartman revealed in early December 2024 that the vulnerability is rooted in the Linux kernel and that it was introduced in version 2.6.26, which was released in mid-2008.
Specifically, it has to do with an out-of-bounds write condition that could arise as a result of parsing frames of type UVC_VS_UNDEFINED in a function named "uvc_parse_format()" in the "uvc_driver.c" program.
This also means that the flaw could be weaponized to result in memory corruption, program crash, or arbitrary code execution.
It's not currently not clear who is behind the exploitation of the vulnerability, although the fact that it could facilitate "physical" privilege escalation suggests possible misuse by forensic data extraction tools, per GrapheneOS.
Also patched as part of Google's monthly security updates is a critical flaw in Qualcomm's WLAN component (CVE-2024-45569, CVSS score: 9.8) that could also lead to memory corruption.
It's worth noting that Google has released two security patch levels, 2025-02-01 and 2025-02-05, so as to give flexibility to Android partners to address a portion of vulnerabilities that are similar across all Android devices more quickly.
"Android partners are encouraged to fix all issues in this bulletin and use the latest security patch level," Google said.
Update
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2024-53104 to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to patch the Linux kernel bug by February 26, 2025.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/02/google-patches-47-android-security.html