Serbian student’s Android phone compromised by exploit from Cellebrite
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-50302 | Kernel Memory Leak via Uninitialized HID Report Buffer in Linux Kernel CVE-2024-50302 is a use of uninitialized resource flaw (CWE-908) in the Linux kernel's HID (Human Interface Device) core, where the shared report buffer was not zero-initialized at allocation. An attacker can trigger it by getting the kernel to process a specially crafted HID report, causing uninitialized kernel memory to be exposed to the requesting driver. The impact is an information disclosure: a local attacker, or a malicious/malfunctioning HID device, could leak kernel memory contents, which could in turn aid further attacks. Because nearly all Linux-based systems compile in HID support, affected code is present in Linux distributions, Android, and Siemens industrial products (SIMATIC S7-1500 TM MFP firmware and SINEC OS). The vulnerability is being actively exploited: CISA added it to the KEV catalog on 2025-03-04, and it is among the actively exploited flaws addressed in Google's March 2025 Android security update. Do: Apply the fixes per vendor channels: install the March 2025 Android security update on Android devices (it is listed as actively exploited and is in CISA KEV, required under BOD 22-01 for federal agencies), and apply Debian kernel updates and Siemens (SIMATIC S7-1500 TM MFP firmware / SINEC OS) updates once issued. Operators should inventory systems running Linux kernels with the HID core (most systems) and prioritize patching, since a local attacker or malicious USB HID device can leak kernel memory; the fix zero-initializes the HID report buffer and is included in current stable kernel branches. | 5.5 | <1% | KEV |
| massBillions of devices ship affected Linux kernel HID code (Linux runs on ~3+ billion Android devices plus millions of servers, desktops, and industrial systems),… | |
| CVE-2024-53104 | Out-of-Bounds Write in Linux Kernel UVC Video Driver (CVE-2024-53104) CVE-2024-53104 is an out-of-bounds write (CWE-787) in the Linux kernel's uvcvideo (USB Video Class) driver: uvc_parse_format does not skip frames of type UVC_VS_UNDEFINED, but those frame types were not accounted for when sizing the frames buffer in uvc_parse_streaming. The flaw is triggered when the kernel parses format/frame descriptors from a USB camera device, so a crafted or nonconforming USB video descriptor can corrupt adjacent kernel memory. An attacker with local, low-privileged access (CVSS 3.1: AV:L/AC:L/PR:L, 7.8 High) can gain kernel memory corruption with high impact to confidentiality, integrity and availability, typically yielding local privilege escalation. Any Linux system or Android device running a kernel that ships the UVC driver is in scope, including Debian and other distributions built from affected kernel sources. Exploitation is confirmed in the wild: the vulnerability was added to CISA's KEV on 2025-02-05, Google fixed it as an actively exploited flaw in the March 2025 Android Security Update, and EPSS currently estimates a 3.4% (88th percentile) probability of exploitation over the next 30 days. Do: Upgrade to a Linux kernel version that contains the uvcvideo fix (apply updated kernel packages from your distribution, e.g. Debian), and for Android devices install the March 2025 Android Security Bulletin patches or later. Follow the CISA KEV required action by applying vendor mitigations or discontinuing use if patches are unavailable. To gauge exposure on unpatched hosts, check whether the UVC driver is loaded (e.g. 'lsmod | grep uvcvideo') and restrict untrusted USB video devices until patched. | 7.8 | 3% | KEV |
| masshundreds of millions of Linux/Android installations potentially carrying the vulnerable driver (Linux kernel runs on billions of devices and the UVC driver… | |
| CVE-2024-53197 | Out-of-Bounds Write in Linux Kernel ALSA USB Audio Driver (CVE-2024-53197) CVE-2024-53197 is an out-of-bounds access/write (CWE-787) in the Linux kernel's USB configuration handling, tied to the ALSA usb-audio driver's handling of Creative Extigy and Mbox devices. A malicious or bogus USB device that reports a bNumConfigurations value larger than the array allocated by usb_get_configuration causes the kernel to access memory beyond the end of dev->config, for example in usb_destroy_configuration. An attacker with local access — or the ability to plug a crafted USB audio device into a target — could corrupt or disclose kernel memory, with high impact to confidentiality, integrity, and availability (CVSS 7.8, local vector), typically as privilege escalation or a kernel crash. Any Linux deployment running a kernel with the vulnerable code is affected, including Debian systems. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-04-09, indicating known exploitation in the wild, though no public proof-of-concept is known and ransomware use is unconfirmed. Do: Update the Linux kernel to a vendor release containing the CVE-2024-53197 fix — for Debian, install the current kernel security update and reboot; other distributions ship the patched kernel in their stable updates. Because exploitation requires a malicious USB audio device, restrict use of untrusted USB peripherals on sensitive or internet-adjacent hosts. Organizations subject to CISA BOD 22-01 must remediate this KEV-listed flaw per the required actions or discontinue use where mitigations are unavailable. | 7.8 | 4% | KEV |
| massmillions of Linux installations (kernel ubiquity across desktops, servers, and Debian; practically reachable only on hosts that accept untrusted USB audio… |
Full article415 words · extracted from arstechnica.com · click to collapse
Amnesty International on Friday said it determined that a zero-day exploit sold by controversial exploit vendor Cellebrite was used to compromise the phone of a Serbian student who had been critical of that country’s government.
The human rights organization first called out Serbian authorities in December for what it said was its “pervasive and routine use of spyware” as part of a campaign of “wider state control and repression directed against civil society.” That report said the authorities were deploying exploits sold by Cellebrite and NSO, a separate exploit seller whose practices have also been sharply criticized over the past decade. In response to the December report, Cellebrite said it had suspended sales to “relevant customers” in Serbia.
Campaign of surveillance
On Friday, Amnesty International said that it uncovered evidence of a new incident. It involves the sale by Cellebrite of an attack chain that could defeat the lock screen of fully patched Android devices. The exploits were used against a Serbian student who had been critical of Serbian officials. The chain exploited a series of vulnerabilities in device drivers the Linux kernel uses to support USB hardware.
“This new case provides further evidence that the authorities in Serbia have continued their campaign of surveillance of civil society in the aftermath of our report, despite widespread calls for reform, from both inside Serbia and beyond, as well as an investigation into the misuse of its product, announced by Cellebrite,” authors of the report wrote.
Amnesty International first discovered evidence of the attack chain last year while investigating a separate incident outside of Serbia involving the same Android lockscreen bypass. Authors of Friday’s report wrote:
The exploit, which targeted Linux kernel USB drivers, enabled Cellebrite customers with physical access to a locked Android device to bypass an Android phone’s lock screen and gain privileged access on the device. As the exploit targets core Linux kernel USB drivers, the impact is not limited to a particular device or vendor and could affect a very wide range of devices. The same vulnerabilities could also expose Linux computers and Linux-powered embedded devices to physical attacks, although there is no evidence of this exploit chain has been designed to target non-Android Linux devices.
The report said that one of the vulnerabilities, tracked as CVE-2024-53104, was patched earlier this month with the release of the February 2025 Android Security Bulletin. Two other vulnerabilities—CVE-2024-53197 and CVE-2024-50302—have been patched upstream in the Linux kernel but have not yet been incorporated into Android.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arstechnica.com/security/2025/02/android-0-day-sold-by-cellebrite-exploited-to-hack-serbian-students-phone/