WARNING: A New Android Zero-Day Vulnerability Is Under Active Attack
2021-03-23T05:33:00
ID THN:EF60CC49D6364DA3E070A9958D3CCDB7 Type thn Reporter The Hacker News Modified 2021-03-23T10:57:24
Description
Google has disclosed that a now-patched vulnerability affecting Android devices that use Qualcomm chipsets is being weaponized by adversaries to launch targeted attacks.
Tracked as CVE-2020-11261 (CVSS score 8.4), the flaw concerns an "improper input validation" issue in Qualcomm's Graphics component that could be exploited to trigger memory corruption when an attacker-engineered app requests access to a huge chunk of the device's memory.
"There are indications that CVE-2020-11261 may be under limited, targeted exploitation," the search giant said in an updated January security bulletin on March 18.
CVE-2020-11261 was discovered and reported to Qualcomm by Google's Android Security team on July 20, 2020, after which it was fixed in January 2021.
It's worth noting that the access vector for the vulnerability is "local," meaning that exploitation requires local access to the device. In other words, to launch a successful attack, the bad actor must either have physical access to the vulnerable smartphone or use other means - e.g., a watering hole - to deliver malicious code and set off the attack chain.
While specifics about the attacks, the identity of the attacker, and the targeted victims have not been released, it is not unusual for Google to withhold sharing such information to prevent other threat actors from taking advantage of the vulnerability.
If anything, the development once again underscores the need to promptly install monthly security updates as soon as they are available to prevent Android devices from being exploited. We've reached out to Google for comment and will update this article if we hear back.
Found this article interesting? Follow THN on Facebook, Twitter and LinkedIn to read more exclusive content we post.
{"id": "THN:EF60CC49D6364DA3E070A9958D3CCDB7", "type": "thn", "bulletinFamily": "info", "title": "WARNING: A New Android Zero-Day Vulnerability Is Under Active Attack", "description": "[](<https://thehackernews.com/images/-fZV9AOkLFZw/YFl4ojMBVdI/AAAAAAAACFY/lDGhJ2azIxIuCePPX34BZU4H_0mtmSfrgCLcBGAsYHQ/s0/android-adb-hack.png>)\n\nGoogle has disclosed that a now-patched vulnerability affecting Android devices that use Qualcomm chipsets is being weaponized by adversaries to launch targeted attacks.\n\nTracked as **CVE-2020-11261** (CVSS score 8.4), the flaw [concerns](<https://www.qualcomm.com/company/product-security/bulletins/january-2021-bulletin>) an \"improper input validation\" issue in Qualcomm's Graphics component that could be exploited to trigger memory corruption when an attacker-engineered app requests access to a huge chunk of the device's memory.\n\n\"There are indications that CVE-2020-11261 may be under limited, targeted exploitation,\" the search giant [said](<https://source.android.com/security/bulletin/2021-01-01>) in an updated January security bulletin on March 18.\n\nCVE-2020-11261 was discovered and reported to Qualcomm by Google's Android Security team on July 20, 2020, after which it was fixed in January 2021.\n\n[](<https://thehackernews.com/images/-hngRw5Tf0vA/YFl3-qMvHtI/AAAAAAAACFQ/DZiVZPyGy7gyqDc233jO0YbxnggQbhdrwCLcBGAsYHQ/s0/android.jpg>)\n\nIt's worth noting that the access vector for the vulnerability is \"local,\" meaning that exploitation requires local access to the device. In other words, to launch a successful attack, the bad actor must either have physical access to the vulnerable smartphone or use other means - e.g., a [watering hole](<https://en.wikipedia.org/wiki/Watering_hole_attack>) \\- to deliver malicious code and set off the attack chain.\n\nWhile specifics about the attacks, the identity of the attacker, and the targeted victims have not been released, it is not unusual for Google to withhold sharing such information to prevent other threat actors from taking advantage of the vulnerability.\n\nIf anything, the development once again underscores the need to promptly install monthly security updates as soon as they are available to prevent Android devices from being exploited. We've reached out to Google for comment and will update this article if we hear back.\n\n \n\n\nFound this article interesting? Follow THN on [Facebook](<https://www.facebook.com/thehackernews>), [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "published": "2021-03-23T05:33:00", "modified": "2021-03-23T10:57:24", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://thehackernews.com/2021/03/warning-new-android-zero-day.html", "reporter": "The Hacker News", "references": [], "cvelist": ["CVE-2020-11261"], "lastseen": "2021-03-23T12:09:20", "viewCount": 65, "enchantments": {"dependencies": {"references": [{"type": "threatpost", "idList": ["THREATPOST:17E00AD621A0ECD9F90FE97E083BF4AC"]}], "modified": "2021-03-23T12:09:20", "rev": 2}, "score": {"value": -0.1, "vector": "NONE", "modified": "2021-03-23T12:09:20", "rev": 2}, "vulnersScore": -0.1}, "immutableFields": []}
{"threatpost": [{"lastseen": "2021-01-06T21:52:10", "bulletinFamily": "info", "cvelist": ["CVE-2016-6328", "CVE-2019-9376", "CVE-2020-10732", "CVE-2020-10766", "CVE-2020-11233", "CVE-2020-11239", "CVE-2020-11240", "CVE-2020-11250", "CVE-2020-11261", "CVE-2020-11262", "CVE-2021-0301", "CVE-2021-0303", "CVE-2021-0304", "CVE-2021-0306", "CVE-2021-0307", "CVE-2021-0309", "CVE-2021-0310", "CVE-2021-0311", "CVE-2021-0312", "CVE-2021-0313", "CVE-2021-0315", "CVE-2021-0316", "CVE-2021-0317", "CVE-2021-0318", "CVE-2021-0319", "CVE-2021-0321", "CVE-2021-0322", "CVE-2021-0323"], "description": "Google has fixed two critical bugs affecting its Android handsets. The more serious flaws exists in the Android System component and allow remote attackers to execute arbitrary code.\n\nThe two critical vulnerabilities are part of Google\u2019s [January Android security bulletin](<https://source.android.com/security/bulletin/2021-01-01>), released Monday. The security update addressed 43 bugs overall for the Android operating systems. As part of this, Qualcomm, whose chips are used in Android devices, patched a mix of high- and critical-severity vulnerabilities tied to 15 bugs.\n\nThe critical-severity flaws include a remote-code-execution flaw in Google\u2019s Android System component (CVE-2021-0316), the core of the Android operating system.\n\n[](<https://threatpost.com/2020-reader-survey/161168/>)\n\nAnother flaw, rated serious, is a denial-of-service issue (CVE-2021-0313) in the Android Framework component, which is a set of APIs (consisting of system tools and user interface design tools) that allow developers to quickly and easily write apps for Android phones.\n\n\u201cThe most severe of these issues is a critical security vulnerability in the System component that could enable a remote attacker using a specially crafted transmission to execute arbitrary code within the context of a privileged process,\u201d according to Google. Both critical flaws are fixed in Android versions 8.0, 8.1, 9, 10 and 11.\n\nBeyond these critical-severity issues, Google fixed a tangle of 13 high-severity flaws in its Framework. This included eight elevation-of-privilege issues (CVE-2021-0303, CVE-2021-0306, CVE-2021-0307, CVE-2021-0310, CVE-2021-0315, CVE-2021-0317, CVE-2021-0318, CVE-2021-0319); four information disclosure glitches (CVE-2021-0304, CVE-2021-0309, CVE-2021-0321, CVE-2021-0322) and one DoS flaw (CVE-2019-9376).\n\nThree high-severity bugs were found in Media Framework (which offers support for playing a variety of common media types, so users can easily utilize audio, video and images). These include a RCE flaw tied to CVE-2016-6328, and two information disclosure flaws tied to CVE-2021-0311 and CVE-2021-0312.\n\nGoogle also rolled out patches for flaws in various third-party components in its Android ecosystem. This included three high-severity flaws in the kernel (CVE-2020-10732, CVE-2020-10766, CVE-2021-0323), which could enable a local malicious application to bypass operating system protections that isolate application data from other applications. A high-severity vulnerability (CVE-2021-0301) was also fixed in the MediaTek component.\n\nFinally, 15 critical and high-severity flaws were addressed in Qualcomm components, including ones affecting the kernel (CVE-2020-11233), display (CVE-2020-11239, CVE-2020-11261, CVE-2020-11262), camera (CVE-2020-11240) and audio components (CVE-2020-11250).\n\nThe fixes come after [a hefty December Android security update](<https://threatpost.com/google-patches-critical-wi-fi-and-audio-bugs-in-android-handsets/162060/>), where Google patched ten critical bugs, including one tied to the Android media framework component that could give attacker remote control of vulnerable handsets.\n\n**Supply-Chain Security: A 10-Point Audit Webinar:** Is your company\u2019s software supply-chains prepared for an attack? On Wed., Jan. 20 at 2p.m. ET, start identifying weaknesses in your supply-chain with actionable advice from experts \u2013 part of a [limited-engagement and LIVE Threatpost webinar](<https://threatpost.com/webinars/supply-chain-security-a-10-point-audit/?utm_source=ART&utm_medium=ART&utm_campaign=Jan_webinar>). CISOs, AppDev and SysAdmin are invited to ask a panel of A-list cybersecurity experts how they can avoid being caught exposed in a post-SolarWinds-hack world. Attendance is limited: **[Register Now](<https://threatpost.com/webinars/supply-chain-security-a-10-point-audit/?utm_source=ART&utm_medium=ART&utm_campaign=Jan_webinar>)** and reserve a spot for this exclusive Threatpost [Supply-Chain Security webinar](<https://threatpost.com/webinars/supply-chain-security-a-10-point-audit/?utm_source=ART&utm_medium=ART&utm_campaign=Jan_webinar>) \u2013 Jan. 20, 2 p.m. ET.\n", "modified": "2021-01-05T20:21:40", "published": "2021-01-05T20:21:40", "id": "THREATPOST:17E00AD621A0ECD9F90FE97E083BF4AC", "href": "https://threatpost.com/google-warns-of-critical-android-remote-code-execution-bug/162756/", "type": "threatpost", "title": "Google Warns of Critical Android Remote Code Execution Bug", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:P"}}]}
