June 2023 Security Update for Android fixed Arm Mali GPU bug used by spyware
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-22706 | Unprivileged Memory-Write Flaw in Arm Mali GPU Kernel Drivers CVE-2022-22706 is a memory-safety flaw (CWE-119) in the Arm Mali GPU kernel driver that lets a local, non-privileged user gain write access to memory pages that should be read-only, potentially enabling privilege escalation or tampering with protected memory (CVSS 3.1: 7.8, local attack vector). It is triggered by a low-privileged local user interacting with the GPU driver on devices running affected Midgard (r26p0-r31p0), Bifrost (r0p0-r35p0), or Valhall (r19p0-r35p0) driver releases, which are widely shipped in Android SoCs such as those from MediaTek and HiSilicon. A successful attacker gains high confidentiality, integrity, and availability impact on the local device. CISA added the bug to the Known Exploited Vulnerabilities catalog on 2023-03-30, and security reporting ties Mali GPU driver zero-day exploitation to commercial spyware campaigns targeting Android and iOS users in Italy, Malaysia, Kazakhstan, and the UAE. The fix reached end users through vendor firmware, including the June 2023 Android security update. Do: Apply updated Arm Mali GPU kernel drivers via your device/SoC vendor's firmware, ensuring Android endpoints are on security patch levels that include the fix (the June 2023 Android Security Bulletin shipped the Mali driver fix). Enterprises should inventory Android devices using Mali-based SoCs (e.g., MediaTek, HiSilicon) and prioritize patching devices exposed to spyware-targeted users; no workarounds are documented, and the CISA KEV required action is to apply updates per vendor instructions. | 7.8 | 1% | KEV |
| masshundreds of millions of Android devices (Mali GPUs are integrated into a large share of Android SoCs; subset running affected driver versions) | |
| CVE-2023-21130 | In btm_ble_periodic_adv_sync_lost of btm_ble_gap.cc, there is a possible remote code execution due to a buffer overflow. In btm_ble_periodic_adv_sync_lost of btm_ble_gap.cc, there is a possible remote code execution due to a buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-273502002 NVD description · AI analysis pending | 9.8 group max | <1% |
| — |
Full article423 words · extracted from securityaffairs.com · click to collapse
June 2023 security update for Android released by Google fixes about fifty flaws, including an Arm Mali GPU bug exploited by surveillance firms in their spyware.
The June 2023 Android Security Bulletin provides details about the fix for more than fifty vulnerabilities affecting Android devices.
Security updates released this month also addressed a vulnerability, tracked as CVE-2022-22706, that affects the Arm Mali GPU. The flaw made headlines because it was exploited by surveillance firms for their spyware.
CVE-2022-22706, a vulnerability in Mali GPU Kernel Driver fixed by ARM in January 2022 and marked as being used in the wild. At the time of delivery, the latest Samsung firmware had not included a fix for this vulnerability. This vulnerability grants the attacker system access.
In March, Google’s Threat Analysis Group (TAG) shared details about two distinct campaigns which used several zero-day exploits against Android, iOS and Chrome. The experts pointed out that both campaigns were limited and highly targeted. The threat actors behind the attacks used both zero-day and n-day exploits in their exploits.
The exploit chains were used to install commercial spyware and malicious apps on targets’ devices. The CVE-2022-22706 vulnerability was exploited as part of these exploit chains.
In early April, U.S. Cybersecurity and Infrastructure Security Agency (CISA) added nine new vulnerabilities to its Known Exploited Vulnerabilities Catalog, including the above issue.
June 2023 Android update includes 2023-06-01 security patch level vulnerability details and 2023-06-05 security patch level vulnerability details.
As usual, the June 2023 Android update is split into two. The first part, which arrives on devices as the 2023-06-01 security patch level, resolves 10 vulnerabilities in the Framework component and 13 bugs in the System component.
Three of these issues are critical-severity remote code execution (RCE) flaws. They are tracked as CVE-2023-21127, CVE-2023-21108, and CVE-2023-21130.
The most severe of these vulnerabilities addressed by Google is a critical security issue that resides in the System component. An attacker can exploit the flaw to achieve remote code execution over Bluetooth, if HFP support is enabled, with no additional execution privileges needed. The experts pointed out that the issue doesn’t require user interaction for exploitation.
“The most severe of these issues is a critical security vulnerability in the System component that could lead to remote code execution over Bluetooth, if HFP support is enabled, with no additional execution privileges needed. User interaction is not needed for exploitation,” reads the advisory.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, surveillance, spyware)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/147186/malware/june-2023-security-update-android-spyware.html