Google fixes actively exploited Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-0889 | In Android TV , there is a possible silent pairing due to lack of rate limiting in the pairing flow. In Android TV , there is a possible silent pairing due to lack of rate limiting in the pairing flow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-8.1 Android-9Android ID: A-180745296 NVD description · AI analysis pending | 9.8 group max | 2% |
| — | ||
| CVE-2021-1048 | Use-After-Free Privilege Escalation in Android Kernel (CVE-2021-1048) CVE-2021-1048 is a use-after-free (CWE-416) in ep_loop_check_proc of eventpoll.c — the Android kernel's epoll event-notification code — that can corrupt kernel memory. A local attacker (e.g., a malicious app with no special permissions) can trigger the flaw, and no user interaction is required, yielding local escalation of privilege to kernel level. Any Android device running an unpatched Android kernel is affected. The flaw is being actively exploited: it is in CISA's Known Exploited Vulnerabilities Catalog (added 2022-05-23) and reporting indicates Google fixed it as a zero-day used in targeted attacks, with coverage tying Android kernel zero-days to Cytrox/Intellexa Predator spyware campaigns. EPSS currently puts the 30-day exploitation probability at ~1.0%, but the KEV listing and in-the-wild targeting make patching urgent. Do: Apply updates per vendor instructions (CISA KEV required action): install the latest Android security/kernel updates from Google or your device OEM — Google's advisories indicate the complete fix shipped in the February 2022 Android security bulletin (2022-02-05 patch level), following the initial January 2022 fix. Fleet administrators should verify devices' security patch levels and prioritize high-value/targeted users, since observed exploitation has been targeted (spyware-linked) rather than mass-scale. No public PoC is known and ransomware use is unknown, but defenders should hunt for signs of local privilege escalation on unpatched fleets. | 7.8 | 1% | KEV |
| mass≈3 billion Android devices worldwide (Android's global active-device installed base; unpatched share unknown) | |
| CVE-2021-1975 +1 in the same advisory: …1924 | Possible heap overflow due to improper length check of domain while parsing the DNS response in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sn Possible heap overflow due to improper length check of domain while parsing the DNS response in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables NVD description · AI analysis pending | 9.8 group max | <1% |
| — |
Full article225 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
November 03, 2021
Google’s Android November 2021 security updates address a zero-day vulnerability in the Kernel that is actively exploited in the wild.
Google’s Android November 2021 security updates addressed 18 vulnerabilities in the framework and system components and 18 issues in the kernel and vendor components.
One of these issues, tracked as CVE-2021-1048, is a use-after-free (UAF) vulnerability in the kernel that could be exploited for privilege escalation. Google is aware that this vulnerability is under limited and targeted exploitation.
The company did not provide technical details about the vulnerability.
The security updates address a total of five critical vulnerabilities, the most severe ones are two remote code execution (RCE) issues tracked as CVE-2021-0918 and CVE-2021-0930 that reside in the System component.
A remote attacker could exploit the two flaws to execute arbitrary code within the context of a privileged process.
The other two critical security vulnerabilities addressed by Google, tracked as CVE-2021-1924 and CVE-2021-1975, affect Qualcomm components.
The fifth critical RCE addressed by Google, tracked as CVE-2021-0889, resides in the Android TV remote service.
Google’s security updates this month addressed another 29 vulnerabilities rated as high-severity in the Framework, Media Framework, System, kernel, Android TV, MediaTek, and Qualcomm components.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Android)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/124113/security/android-zero-day-kernel.html