Google fixes new 0-day vulnerability in Android

With the Android Security Bulletin for September 2024, Google documents, usually on the first Monday of each month, the vulnerabilities in the mobile operating system that its developers have eliminated in the open source code. In addition, there are security patches from the Linux kernel and security-relevant bug fixes from chip manufacturers. Google publishes a separate report with plugged security holes for its Pixel devices – but often with some delay.

Two patch levels in the security bulletin

The closed security gaps are usually distributed across two so-called patch levels. The first, September 1, 2024, contains the closed AOSP (Android Open Source Project) gaps. Patch level 2024-09-05 documents the closed gaps in the Linux kernel (as far as they affect Android) and in the chipsets of various suppliers. The latter always only affect some of the Android devices, as their manufacturers use different hardware components. Google obliges the manufacturer to implement the appropriate security patches.

Patch level 2024-09-01 with a 0-day gap

For patch level 2024-09-01, the September security bulletin lists ten fixed vulnerabilities in the core components of the operating system. Google classifies all vulnerabilities as high risk. Exploiting most vulnerabilities can give an attacker extended local privileges (EoP). Without providing further details, Google warns that there are signs of “limited, targeted attacks” exploiting the CVE-2024-32896 vulnerability. All Android versions (12 to 14) are potentially at risk.

An update to close the CVE-2024-40659 security vulnerability will be distributed via Google Play in September as part of the Mainline project. These updates are intended for devices running Android 12 to 14 that no longer receive manufacturer support.

▶The latest security updates

Patch Level 2024-09-05 with two critical vulnerabilities

For the hardware-related patch level 2024-09-05, the September bulletin lists 25 closed vulnerabilities. Among them is a high-risk vulnerability (CVE-2024-36972) in the upstream kernel (Linux).

All other vulnerabilities are also classified as high risk. They are spread across components from chip suppliers ARM (Mali GPU), Imagination Technologies (PowerVR GPU), Unisoc and Qualcomm. Qualcomm alone has 19 security vulnerabilities, two of which (CVE-2024-33042, -33052) are classified as critical. They affect Qualcomm’s WLAN component.

Pixel Update Bulletin with four critical vulnerabilities

The separate bulletin for Google’s Pixel devices even came out a few hours before the Android security bulletin this month. Google only released both on September 3 because Monday was Labor Day, a holiday in the US and Canada.

The September Pixel Update Bulletin documents the vulnerabilities fixed in Pixel devices in addition to those fixed in the Android Security Bulletin. This month, there are six vulnerabilities, four of which Google classifies as critical. An attacker who exploits one of these vulnerabilities could gain increased capabilities. The other two vulnerabilities are considered high risk.

The number of smartphone and tablet manufacturers that provide more or less regular security updates for their devices has increased over the years, but there is still a lot of room for improvement. This is all the more true as some manufacturers only offer monthly updates for their expensive top models. While Samsung delivers the updates promptly, often even before Google, other manufacturers sometimes lag several weeks (or longer) behind.