Google Patches New Android Kernel Vulnerability Exploited within the Wild

Aug 06, 2024 Ravie LakshmananMobile Safety / Vulnerability
Google has addressed a significant safety factor affecting the commonly exploited Android kernel. The vulnerability, codenamed CVE-2024-36971, has been described as a far flung gadget factor affecting the kernel. “There are indications that CVE-2024-36971 is also partly suppressed,” the technical skilled wrote in his per thirty days Android safety factor in August 2024. As standard, the corporate didn’t percentage any additional info at the atmosphere. Cyber ​​assaults that exploit the vulnerability or faux that the job threatens a specific actor or team. It’s not identified if Pixel gadgets also are suffering from the trojan horse.

That mentioned, Clement Lecigne of Google’s Risk Research Workforce (TAG) has been credited with reporting the trojan horse, suggesting it can be being utilized by adware distributors to infiltrate Android gadgets for centered assaults. The August patch addresses a complete of 47 vulnerabilities, together with the ones recognized in teams associated with Arm, Creativeness Applied sciences, MediaTek, and Qualcomm. The problems resolved by means of Google are 12 privilege escalation vulnerabilities, one data disclosure vulnerability, and one denial of carrier (DoS) vulnerability affecting the Android Framework. In June 2024, a analysis company published {that a} vulnerability in Pixel Firmware (CVE-2024-32896) has been used as a part of a low-level and centered vulnerability. Google later advised The Hacker Information that the vulnerability extends to Pixel gadgets together with the principle Android platform and that it’s operating with OEM companions to enforce the important fixes. Previous, the corporate additionally closed two safety flaws within the bootloader and firmware gear (CVE-2024-29745 and CVE-2024-29748) that have been created by means of regulation enforcement corporations to thieve information.

The advance comes as america Cybersecurity and Infrastructure Safety Company (CISA) added CVE-2018-0824, a far flung vulnerability affecting Microsoft COM for Home windows to its checklist of identified Exploited Vulnerabilities (KEV), which calls for govt businesses to take advantage of it by means of August 26. , 2024. The replace follows a document from Cisco Talos that the flaw was once created by means of a Chinese language risk actor named APT41 in a cyber assault that centered an unnamed analysis group by means of the federal government of Taiwan to take advantage of their alternatives.

Did you in finding this text attention-grabbing? Observe us on Twitter  and LinkedIn to learn extra of our content material.

Author: OpenAI