Google releases Android August patches, fixes at least one exploited flaw
Take action: This patch has a couple of interesting fixes for Android - although the actively exploited one needs physical access to the device. It's wise to apply the Android patch as soon as your vendor releases an update for your phone. Depending on the vendor you might wait for some weeks/months before the update is released for your phone.
Learn More
The Android Security Bulletin for August 2024, fixes multiple security vulnerabilities impacting Android devices. Source code patches for these vulnerabilities will be made available in the Android Open Source Project (AOSP) repository within the next 48 hours, and the bulletin will be updated with AOSP links once released.
Vulnerabilities to pay attention to
- CVE-2024-36971 (CVSS score 7.8): A high-severity remote code execution (RCE) vulnerability in the Kernel component, potentially under limited, targeted exploitation.
- CVE-2024-23350: Critical vulnerability in a closed-source component of Quallcom chipset
Detailed Vulnerability Breakdown
Framework Vulnerabilities
- CVE-2023-20971: Elevation of Privilege (EoP) affecting Android versions 12, 12L, 13, 14.
- CVE-2023-21351: EoP affecting Android versions 12, 12L, 13.
- CVE-2024-34731: EoP affecting Android versions 12, 12L, 13, 14.
- CVE-2024-34734: EoP affecting Android versions 13, 14.
- CVE-2024-34735: EoP affecting Android versions 12, 12L, 13.
- CVE-2024-34737: EoP affecting Android versions 12, 12L, 13, 14.
- CVE-2024-34738: EoP affecting Android versions 13, 14.
- CVE-2024-34739: EoP affecting Android versions 12, 12L, 13, 14.
- CVE-2024-34740: EoP affecting Android versions 12, 12L, 13, 14.
- CVE-2024-34741: EoP affecting Android versions 12, 12L, 13, 14.
- CVE-2024-34743: EoP affecting Android version 14.
- CVE-2024-34736: Information Disclosure (ID) affecting Android versions 12, 12L, 13, 14.
- CVE-2024-34742: Denial of Service (DoS) affecting Android version 14.
System Vulnerabilities
- CVE-2024-34727: ID vulnerability affecting Android versions 12, 12L, 13, 14.
Kernel Vulnerabilities
- CVE-2024-36971: RCE vulnerability affecting the kernel, potentially under targeted exploitation.
Other Component Vulnerabilities
- Arm Components:
- CVE-2024-2937: High-severity vulnerability in Mali.
- CVE-2024-4607: High-severity vulnerability in Mali.
- Imagination Technologies:
- CVE-2024-31333: High-severity vulnerability in PowerVR-GPU.
- MediaTek Components:
- CVE-2024-20082: High-severity vulnerability in Modem.
- Qualcomm Components:
- Multiple high-severity vulnerabilities affecting Display and WLAN components.
Android users should update their devices to the latest security patch level to mitigate these vulnerabilities. Users can check their device's security patch level and update it through their settings.
