Android Security Updates: Patch for Critical RCE Vulnerabilities

The January 2025 Android Security Bulletin has issued important updates regarding critical vulnerabilities that affect Android devices.

Users are urged to ensure their devices are updated to the latest security patch level, which as per the bulletin, should be 2025-01-05 or later to mitigate potential risks.

Overview of Vulnerabilities

The bulletin highlights a series of Remote Code Execution (RCE) vulnerabilities within the Android System component.

These vulnerabilities are deemed critical due to the potential impact they can have on affected devices, especially if the platform’s inherent security mitigations are bypassed.

The Android security team emphasizes that these vulnerabilities could allow attackers to execute harmful code without needing additional privileges.

In response to these vulnerabilities, Android partners were informed at least a month before the bulletin’s publication.

Source code patches for these vulnerabilities are set to be released in the Android Open Source Project (AOSP) repository within 48 hours. Updated links to the AOSP will be provided once they are available.

Severity Assessment

The vulnerabilities listed below are critical and categorized according to their CVE IDs. They are grouped under the component they affect, providing insights into their severity and the specific AOSP versions they impact.

CVE ID	Type	Severity	Updated AOSP Versions
CVE-2024-43096	RCE	Critical	12, 12L, 13, 14, 15
CVE-2024-43770	RCE	Critical	12, 12L, 13, 14, 15
CVE-2024-43771	RCE	Critical	12, 12L, 13, 14, 15
CVE-2024-49747	RCE	Critical	12, 12L, 13, 14, 15
CVE-2024-49748	RCE	Critical	12, 12L, 13, 14, 15

The Android security platform and Google Play Protect provide vital protections that reduce the likelihood of successful exploitation of these vulnerabilities.

Users are advised to remain vigilant and ensure their devices are updated regularly to the latest Android version.

Google Play Protect, which comes enabled by default on devices with Google Mobile Services, plays a crucial role in safeguarding users against potentially harmful applications and threats.

Staying updated with the latest security patches is crucial for all Android users. Regular updates not only protect devices from known vulnerabilities but also enhance overall security, ensuring a safer mobile experience.

ANY.RUN Threat Intelligence Lookup - Extract Millions of IOC's for Interactive Malware Analysis: Try for Free