Google Warns of Actively Exploited CVE-2024
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-32896 | Local Privilege Escalation in Google Android Pixel Kernel CVE-2024-32896 is a logic error (CWE-670/CWE-783) in Android code on Google Pixel devices that allows a bypass leading to local escalation of privilege. The flaw is triggered through local access with no additional execution privileges required, and user interaction is needed for exploitation to succeed. A successful attack yields high impact to confidentiality, integrity, and availability on the affected device (CVSS 3.1 base score 7.8), giving an attacker elevated control of the phone. Per CISA's advisory, only Google Pixel devices running Android are affected. The vulnerability is being exploited in the wild: it was added to CISA's KEV catalog on 2024-06-13, and news coverage describes limited, targeted exploitation of the Android kernel flaw as a zero-day, with users urged to install the latest security updates. Do: Apply the latest Android security updates from Google (June 2024 security patch level or later) to all Pixel devices, per vendor instructions and CISA's required action. Users can verify their patch level under Settings > About phone > Android security update. Given reports of limited, targeted zero-day exploitation, prioritize patching high-risk users and treat the flaw as a post-compromise privilege-escalation risk. | 7.8 | 3% | KEV |
| masstens of millions of Pixel devices (estimated active Pixel install base; exact count unknown) | |
| CVE-2024-43047 | Use-After-Free in Qualcomm FastConnect and QCA Chipset Firmware CVE-2024-43047 is a use-after-free vulnerability (CWE-416) in the firmware of several Qualcomm connectivity chipsets and the QAM8295P automotive SoC, where maintaining memory maps of high-level operating system (HLOS) memory causes memory corruption. The flaw is scored with a local attack vector and low privileges required (CVSS 3.1: 7.8), so an attacker needs some local foothold, such as a malicious app on an Android device, and can then leverage the memory corruption for high-impact confidentiality, integrity, and availability effects, in practice a privilege escalation to system or kernel level. Anyone running devices built on the affected chips is exposed, including Android smartphones with FastConnect 6700/6800/6900/7800, devices using QCA-series Wi-Fi chips, and automotive platforms using the QAM8295P. The vulnerability is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-10-08, and news reports describe targeted, limited Android attacks, though ransomware use is unknown and EPSS remains modest at 0.7%. Do: Apply Qualcomm's fix through your device or system OEM: install the latest Android security updates on affected phones, and update firmware/drivers for QCA-series Wi-Fi chips and the QAM8295P automotive SoC per vendor instructions; because this is a local firmware flaw, there is no user-side mitigation short of patching. Organizations under CISA KEV must remediate per the required action (apply vendor remediations or discontinue use). Prioritize an inventory of Android devices with FastConnect 6700/6800/6900/7800 and QCA6xxx/65xxx chips, noting this flaw is being used in targeted attacks rather than mass-scale campaigns. | 7.8 | <1% | KEV |
| massplausibly hundreds of millions of devices (affected Qualcomm FastConnect and QCA connectivity chips ship across Android smartphones, PCs with Qualcomm Wi-Fi… | |
| CVE-2024-43093 | Local Privilege Escalation via Unicode Path Filter Bypass in Android Framework CVE-2024-43093 is a privilege escalation flaw in the Android Framework's ExternalStorageProvider (the component behind the system document/file picker), where the shouldHideDocument function mishandles Unicode normalization, allowing crafted file paths to bypass the filter that hides sensitive directories such as app-private storage (CWE-176). It is triggered locally: an app with no additional execution privileges can exploit it with user interaction, for example when a user selects a file or location through the documents UI. A successful bypass grants unauthorized access to otherwise protected directories and can lead to local escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 7.3, vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). Any device running the Android Framework is in scope, meaning effectively the entire Android installed base, although the local access and user-interaction requirements limit practical exploitability to targeted scenarios. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-11-07 and Google has indicated it may be under limited, targeted exploitation; no public proof-of-concept is known, and EPSS currently rates the 30-day exploitation probability at a modest 0.7%, though the KEV listing is the authoritative in-the-wild signal. Do: Apply Google's Android security updates immediately — the fix is included in the November 2024 Android Security Bulletin (security patch level 2024-11-01) or later — and verify the device's security patch level in Settings; OEM devices (e.g., Samsung) may receive the fix through vendor updates on a lag. Per the CISA KEV required action, treat patching as urgent or apply vendor mitigations, and as an interim measure restrict sideloaded/untrusted app installs and caution users when picking files through the document picker. Ransomware linkage is unknown, and the user-interaction requirement means exploitation is targeted rather than wormable. | 7.3 | <1% | KEV |
| massbillions of Android devices worldwide (Android runs on roughly 70% of global smartphones) |
Full article301 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananNov 05, 2024Mobile Security / Vulnerability
Google has warned that a security flaw impacting its Android operating system has come under active exploitation in the wild.
The vulnerability, tracked as CVE-2024-43093, has been described as a privilege escalation flaw in the Android Framework component that could result in unauthorized access to "Android/data," "Android/obb," and "Android/sandbox" directories, and their respective sub-directories, according to a code commit message.
There are currently no details about how the vulnerability is being weaponized in real-world attacks, but Google acknowledged in its monthly bulletin that there are indications it "may be under limited, targeted exploitation."
The tech giant has also flagged CVE-2024-43047, a now-patched security bug in Qualcomm chipsets, as having been actively exploited. A use-after-free vulnerability in the Digital Signal Processor (DSP) Service, a successful exploitation of the security flaw could lead to memory corruption.
Last month, the chipmaker credited Google Project Zero researcher Seth Jenkins and Conghui Wang for reporting the flaw, and Amnesty International Security Lab for confirming the in-the-wild activity.
The advisory offers no details on the exploit activity targeting the flaw or when it might have started, although it's possible that it may have been leveraged as part of highly targeted spyware attacks aimed at civil society members.
It's also currently not known if both the security vulnerabilities were fashioned together as an exploit chain to elevate privileges and achieve code execution.
CVE-2024-43093 is the second actively exploited Android Framework flaw after CVE-2024-32896, which was patched by Google back in June and September 2024. While it was originally resolved only for Pixel devices, the company later confirmed that the flaw impacts the broader Android ecosystem.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/11/google-warns-of-actively-exploited-cve.html