Friday, March 29, 2024

Critical Android Security Vulnerability Let Remote Attacker Cause Permanent Denial of Service

Google released security updates for Android that deploy fixes for 15 vulnerabilities with severity level critical, high and moderate and another 22 vulnerabilities patched Qualcomm components.

The source code for the issues to be released with the Android Open Source Project (AOSP) repository and Google said that “partners notified about the issue before a month.”

Security Vulnerabilities

CVE-2019-2232

Among them, the most severe one is the security vulnerability with the Android framework component. The vulnerability can be tracked CVE-2019-2232, it allows a remote attacker to cause a permanent denial of service which may result in bricking of the phone.

The vulnerability can be exploited by a remote attacker using a specially crafted message without any user interaction. Improper input validation in handleRun of TextLine.java with the component Unicode Handler leads to denial of service with no user privileges.

Technical details of the vulnerability were not disclosed, Android versions affected: 8.0/8.1/9.0/10.0.

CVE-2019-2222

The vulnerability is classified as critical and it affects ihevcd_parse_slice_data of ihevcd_parse_slice.c function. It writes outside the bounds of allocated memory due to missing bounds check.

It may result in remote code execution and to exploit the vulnerability user interaction is required. Android versions affected: 8.0/8.1/9.0/10.0.

CVE-2019-2223

It affects ihevcd_ref_list of ihevcd_ref_list.c, another out of bounds write vulnerability due to missing bounds check. It allows an attacker to execute code remotely without any additional privileges. Android versions affected: 8.0/8.1/9.0/10.0.

Vulnerability Mitigation

The update for the patches depends upon the Android device manufacturer. The good news is that there are no current reports of these vulnerabilities exploited.

Samsung said that it is ” is releasing a maintenance release for major flagship models as part of the monthly Security Maintenance Release (SMR) process. This SMR package includes patches from Google and Samsung.”

LG has rolled out patches for December 2019 security bulletin, covering three critical security vulnerabilities.

Google said that “Google devices start receiving OTA updates on the same day the monthly bulletin is released. In general, it takes about one and a half calendar weeks for the OTA to reach every Google device.”

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government...

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles