Google releases September 2024 patches, at least one exploited flaw
Take action: One exploited flaw and one critical in Quallcom chips. It's wise to apply the Android patch as soon as your vendor releases an update for your phone. Depending on the vendor you might wait for some weeks/months before the update is released for your phone.
Learn More
Google has released the Android Security Bulletin for September 2024, detailing several vulnerabilities affecting various components of the Android operating system. Security patches dated 2024-09-05 or later address all identified issues. Android partners were informed of these vulnerabilities at least one month before publication. Source code patches for these issues will be made available in the Android Open Source Project (AOSP) repository within 48 hours.
The most severe vulnerabilities in the Framework component could lead to local escalation of privilege (EoP) without needing additional execution privileges:
- CVE-2024-32896 (High Severity) - EoP in Android versions 12, 12L, 13, and 14. There are indications that this flaw is under limited, targeted exploitation.
- CVE-2024-40658 (High Severity) - EoP in Android versions 12, 12L, 13, and 14.
- CVE-2024-40662 (High Severity) - EoP in Android versions 12, 12L, 13, and 14.
The following vulnerabilities in the System and Kernel components could also result in local EoP:
- CVE-2024-40650 to CVE-2024-40657 (High Severity) - Affect Android versions 12, 12L, 13, and 14.
- CVE-2024-40659 (High Severity) - Denial of Service (DoS) in Android version 14.
- CVE-2024-36972 (High Severity) - EoP affecting the Net subcomponent in the Linux Kernel.
These vulnerabilities affect specific hardware components:
- CVE-2024-3655 (High Severity) - Affects the Mali subcomponent in ARM.
- CVE-2024-23716 and CVE-2024-31336 (High Severity) - Affect the PowerVR-GPU in Imagination Technologies.
- CVE-2024-39431 and CVE-2024-39432 (High Severity) - Affect the modem in Unisoc components.
Several critical and high-severity vulnerabilities affect Qualcomm components:
- Critical Severity Vulnerabilities:
- CVE-2024-33042 and CVE-2024-33052 - Affect the WLAN component.
- High Severity Vulnerabilities:
- Affect multiple subcomponents, including Display, Camera, Bootloader, and Kernel.
All users are strongly advised to update to the latest Android version available for their device to ensure protection against these vulnerabilities. More information can be found in the original Android Security Bulletin—September 2024.
