Google releases November 2024 Android Update, fixes actively exploited flaws
Take action: One critical and two actively exploited flaws in this release. Plan to update your Android OS as soon as your vendor releases an update for your phone. Depending on the vendor you might wait for some weeks/months before the update is released for your phone.
Learn More
Google's November 2024 Android security update addresses 51 vulnerabilities, including two actively exploited zero-day vulnerabilities. Users are advised to update to the security patch level of 2024-11-05 or later to protect against these threats.
-
CVE-2024-38408 (CVSS score 8.1) - Qualcomm Closed-Source Component Vulnerability - This vulnerability affects Qualcomm’s closed-source component, allowing potential attackers to exploit security flaws that could compromise affected devices.
Actively exploited flaws in spyware
-
CVE-2024-43093 (CVSS score not disclosed) - Privilege Escalation in Android Framework - an elevation of privilege vulnerability (EoP) within the Android Framework allows unauthorized access to sensitive directories and subdirectories, such as Android/data, Android/obb, and Android/sandbox. Affected Versions are Android 12 through 15.
-
CVE-2024-43047 (CVSS score 7.8) - Use-After-Free in Qualcomm DSP Service - a use-after-free vulnerability impacts Qualcomm’s Digital Signal Processor (DSP) service. Attackers could exploit it to cause memory corruption, leading to privilege escalation. Reported by Google Project Zero and confirmed by Amnesty International’s Security Lab, the exploitation has been linked to possible spyware attacks, suggesting targeted use, possibly in surveillance operations.
The November 2024 security update is available in two patch levels:
- November 1 Patch Level: Covers core Android components, addressing framework vulnerabilities like CVE-2024-43093.
- November 5 Patch Level: Targets vendor-specific vulnerabilities, including CVE-2024-43047 in Qualcomm components, among others in MediaTek, Imagination Technologies, and other hardware providers.
Android device users are encouraged to install the November security update immediately:
- To update: Go to Settings > System > Software updates > System update or Settings > Security & privacy > System & updates > Security update.
- After installation: Restart the device to apply the updates.
