Google Detects Android Spyware That Spies On WhatsApp, Skype Calls

The Linux kernel's perf event subsystem fails to validate all 64 bits of the attr.config value supplied from user space, causing an out-of-bounds access to the perf_swevent_enabled array in sw_perf_event_destroy(). A local attacker triggers the flaw by creating a perf event with a crafted attr.config value, and the out-of-bounds access occurs when that event is destroyed, corrupting adjacent kernel memory. By corrupting memory this way, an attacker can escalate privileges from an unprivileged local user to kernel-level (root) privileges on the affected system. Any system running an affected Linux kernel where perf events are available is exposed; the provided data does not specify exact affected kernel version ranges, so operators should confirm against vendor advisories. The vulnerability is actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-09-15, and EPSS assigns it a 47.7% probability of exploitation within 30 days (99th percentile).

Do: Apply kernel updates per vendor instructions as required by CISA, then reboot so the system runs the patched kernel. As interim mitigation, restrict unprivileged access to perf events (e.g., by raising the perf_event_paranoid sysctl) and limit untrusted local shell access. Verify the running kernel version against your distribution's advisory for this CVE before and after remediation.

CVE-2013-2596 is an integer overflow in the fb_mmap function in drivers/video/fbmem.c of the Linux kernel, a memory-mapping routine for framebuffer devices. The flaw is triggered when the kernel performs the arithmetic used to map framebuffer memory, and the overflowed calculation can yield an incorrect mapping that an attacker can leverage. An attacker who successfully exploits it gains elevated privileges on the affected system. Any system running an affected Linux kernel build is exposed, with the practical attack surface concentrated on systems where users can memory-map framebuffer devices; the specific vulnerable version range is not specified in the available data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-09-15, indicating exploitation in the wild, though no public proof-of-concept is known, ransomware use is unknown, and EPSS puts 30-day exploitation probability at 3.2% (87th percentile).

Do: Apply updated kernel packages per your distribution or vendor's instructions, as CISA's required action directs, prioritizing internet-exposed and multi-user systems. As an interim mitigation, audit which systems permit unprivileged access to framebuffer devices (/dev/fb*) and restrict that access. Because fixed version numbers are not specified in the available data, confirm exact patched kernel versions with your vendor before declaring remediation complete.

A stack-based buffer overflow (CWE-119) exists in the audio calibration database (acdb) audio driver from Code Aurora, the code incorporated into third-party products such as Qualcomm and Android. An attacker who can get crafted input to this driver can overwrite stack memory and escalate privileges to a higher-than-intended level on the device. Any device shipping the vulnerable Code Aurora ACDB audio driver — notably Qualcomm-powered Android products — is potentially affected, though the available data does not specify affected version ranges. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-09-15, while EPSS estimates a 1.5% probability of exploitation in the next 30 days and no public proof-of-concept is known.

Do: Apply updated audio drivers/firmware from your chipset or device vendor as soon as available, per CISA's required action to apply updates per vendor instructions, and check Qualcomm and Android security bulletins for fixes covering CVE-2013-2597. Because this is a local privilege escalation, prioritize Qualcomm-based Android devices where untrusted apps or users can execute code, and limit installation of untrusted applications on affected devices until patched.

CVE-2013-6282 is an improper input validation flaw (CWE-20) in the Linux kernel's get_user and put_user API functions, which on ARM v6k/v7 platforms fail to validate the target address before accessing it. When kernel code uses these functions with an application-supplied pointer, the address is not verified as user space, so a local application can supply a kernel-space address (for example via system calls or ioctls) and read and write kernel memory. An attacker who can already run code on the device can leverage this kernel memory access to escalate privileges to root/kernel level, which can enable persistence or further post-exploitation activity. Affected systems are Linux kernels running on ARM v6k/v7 processors, the architecture that dominated Android smartphones and much embedded Linux hardware in that era; the source data does not enumerate specific affected kernel version ranges. Despite the flaw's 2013 origin, CISA added it to the Known Exploited Vulnerabilities catalog on 2022-09-15, confirming exploitation in the wild, with EPSS estimating a 39.7% probability of exploitation within 30 days (99th percentile).

Do: Apply updates per vendor instructions (CISA required action): upgrade the Linux kernel on ARM v6k/v7 devices to a vendor-patched version and install OEM/Google security updates on Android devices, checking vendor advisories for the fixed kernel builds. Inventory legacy and internet-exposed ARM-based embedded systems still running old kernels, and because this is a local privilege escalation, restrict execution of untrusted applications and code on affected devices.

CVE-2014-3153 is a local privilege escalation flaw in the futex_requeue function of kernel/futex.c in the Linux kernel, where the code does not ensure that a requeue operation involves two different futex addresses. A local, unprivileged user triggers it by issuing crafted futex system calls that requeue a futex back to the same address, corrupting kernel state in the futex priority-inheritance queue. An attacker who exploits it can execute code with kernel-level (root) privileges, fully compromising the host without any network access; the bug was also the basis of the 2014 'Towelroot' one-click Android rooting exploit. Any Linux system running an affected, unpatched kernel is exposed - servers, Android handsets, and embedded devices - although exploitation requires the ability to run code locally on the target. The vulnerability is listed in CISA KEV (added 2022-05-25), indicating known in-the-wild exploitation, with EPSS at 37.2% (98th percentile) and no public PoC catalogued in the source data.

Do: Apply kernel updates per vendor instructions (CISA required action): upgrade affected Linux systems to a kernel release from your distribution that includes the futex fix, and confirm the running version with 'uname -r' against your vendor's advisory. Because exploitation requires local code execution, prioritize multi-tenant servers, shared/embedded appliances, and Android device fleets where untrusted users or apps run locally, and monitor those systems for signs of local privilege escalation until patched.