Google fixes Android zero-day exploited in the wild in targeted attacks

CVE-2021-1048 is a use-after-free (CWE-416) in ep_loop_check_proc of eventpoll.c — the Android kernel's epoll event-notification code — that can corrupt kernel memory. A local attacker (e.g., a malicious app with no special permissions) can trigger the flaw, and no user interaction is required, yielding local escalation of privilege to kernel level. Any Android device running an unpatched Android kernel is affected. The flaw is being actively exploited: it is in CISA's Known Exploited Vulnerabilities Catalog (added 2022-05-23) and reporting indicates Google fixed it as a zero-day used in targeted attacks, with coverage tying Android kernel zero-days to Cytrox/Intellexa Predator spyware campaigns. EPSS currently puts the 30-day exploitation probability at ~1.0%, but the KEV listing and in-the-wild targeting make patching urgent.

Do: Apply updates per vendor instructions (CISA KEV required action): install the latest Android security/kernel updates from Google or your device OEM — Google's advisories indicate the complete fix shipped in the February 2022 Android security bulletin (2022-02-05 patch level), following the initial January 2022 fix. Fleet administrators should verify devices' security patch levels and prioritize high-value/targeted users, since observed exploitation has been targeted (spyware-linked) rather than mass-scale. No public PoC is known and ransomware use is unknown, but defenders should hunt for signs of local privilege escalation on unpatched fleets.

CVE-2021-1906 is an availability flaw in the GPU component of numerous Qualcomm chipsets: improper handling of address deregistration on failure can cause subsequent new GPU address allocations to fail. A local attacker with low privileges (for example, a malicious or compromised app or process on an Android device) can trigger the failure condition, causing GPU allocation failures that can hang or crash the affected device. The CVSS vector (C:N/I:N/A:H) confirms there is no confidentiality or integrity impact, so the attacker gains denial of service rather than code execution or data theft. It affects firmware for Qualcomm APQ8009, APQ8009W, APQ8017, APQ8053, APQ8064AU, APQ8096AU, AQT1000, AR8031, AR8035, AR8151, CSRA6620, and CSRA6640 across Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, and Wearables product lines. CISA added the vulnerability to the KEV catalog on 2021-11-03, and it was addressed in Android security updates alongside other Qualcomm and Arm zero-days that Google reported as being used in targeted attacks.

Do: Install the November 2021 (or later) Android security bulletin and Qualcomm-supplied fixes on affected phones, tablets, and embedded devices, and obtain updated firmware from device/OEM vendors for Snapdragon-based automotive, IoT, and connectivity products. Because the flaw is only exploitable locally with low privileges, exposure requires attacker code already running on the device, so applying vendor updates and checking chipset model (APQ8009/APQ8009W/APQ8017/APQ8053/APQ8064AU/APQ8096AU/AQT1000/AR8031/AR8035/AR8151/CSRA6620/CSRA6640) to confirm applicability are the key actions.

CVE-2021-28663 is a use-after-free flaw in the Arm Mali GPU kernel driver, caused by mishandled GPU memory operations in the Midgard, Bifrost, and Valhall driver families. An attacker who can run code with limited privileges on a device can trigger the flaw through GPU memory operations, gaining local privilege escalation or disclosure of sensitive information (CISA's CVSS scoring uses a network attack vector). The bug is present in Midgard drivers r4p0 through r30p0, Bifrost r0p0 through r28p0 (before r29p0), and Valhall r19p0 through r28p0 (before r29p0), which ship on Android devices using Mali GPUs. It was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 and was patched as part of Android security updates after Google reported it being actively exploited in targeted attacks; a public proof of concept is available on GitHub.

Do: Apply Android security updates (November 2021 patch level or later) and OEM/Arm driver updates per vendor instructions, upgrading the Bifrost and Valhall GPU kernel drivers to r29p0 or later; for Midgard, move beyond the affected r4p0-r30p0 range to the latest available driver release. Organizations managing Android fleets should check device patch levels and Mali driver versions via device management tooling and prioritize this because it is on the CISA KEV list with exploitation observed in targeted attacks. Where patching is delayed, limit exposure for low-privileged users on affected devices, as exploitation requires the ability to run code on the device.