Over 1 Million Google Accounts Hacked by 'Gooligan' Android Malware

CVE-2013-6282 is an improper input validation flaw (CWE-20) in the Linux kernel's get_user and put_user API functions, which on ARM v6k/v7 platforms fail to validate the target address before accessing it. When kernel code uses these functions with an application-supplied pointer, the address is not verified as user space, so a local application can supply a kernel-space address (for example via system calls or ioctls) and read and write kernel memory. An attacker who can already run code on the device can leverage this kernel memory access to escalate privileges to root/kernel level, which can enable persistence or further post-exploitation activity. Affected systems are Linux kernels running on ARM v6k/v7 processors, the architecture that dominated Android smartphones and much embedded Linux hardware in that era; the source data does not enumerate specific affected kernel version ranges. Despite the flaw's 2013 origin, CISA added it to the Known Exploited Vulnerabilities catalog on 2022-09-15, confirming exploitation in the wild, with EPSS estimating a 39.7% probability of exploitation within 30 days (99th percentile).

Do: Apply updates per vendor instructions (CISA required action): upgrade the Linux kernel on ARM v6k/v7 devices to a vendor-patched version and install OEM/Google security updates on Android devices, checking vendor advisories for the fixed kernel builds. Inventory legacy and internet-exposed ARM-based embedded systems still running old kernels, and because this is a local privilege escalation, restrict execution of untrusted applications and code on affected devices.

CVE-2014-3153 is a local privilege escalation flaw in the futex_requeue function of kernel/futex.c in the Linux kernel, where the code does not ensure that a requeue operation involves two different futex addresses. A local, unprivileged user triggers it by issuing crafted futex system calls that requeue a futex back to the same address, corrupting kernel state in the futex priority-inheritance queue. An attacker who exploits it can execute code with kernel-level (root) privileges, fully compromising the host without any network access; the bug was also the basis of the 2014 'Towelroot' one-click Android rooting exploit. Any Linux system running an affected, unpatched kernel is exposed - servers, Android handsets, and embedded devices - although exploitation requires the ability to run code locally on the target. The vulnerability is listed in CISA KEV (added 2022-05-25), indicating known in-the-wild exploitation, with EPSS at 37.2% (98th percentile) and no public PoC catalogued in the source data.

Do: Apply kernel updates per vendor instructions (CISA required action): upgrade affected Linux systems to a kernel release from your distribution that includes the futex fix, and confirm the running version with 'uname -r' against your vendor's advisory. Because exploitation requires local code execution, prioritize multi-tenant servers, shared/embedded appliances, and Android device fleets where untrusted users or apps run locally, and monitor those systems for signs of local privilege escalation until patched.