Security News > 2021 > June > Google Patches Critical Android RCE Bug
Google patched more than 90 security vulnerabilities in its Android operating system impacting its Pixel devices and third-party Android handsets, including a critical remote code-execution bug that could allow an attacker to commandeer a targeted vulnerable mobile device.
The Android System component of the OS also has a second critical vulnerability, an elevation-of-privilege issue tracked as CVE-2021-0516.
Google also addressed several high-severity EoP issues in other components within the OS, including one in Android runtime that could enable a local attacker to execute arbitrary code and bypass user interaction requirements in order to gain access to additional permissions.
The bugs in Google's Pixel devices are mainly rated moderate in severity, including a pair of denial-of-service problems in Android runtime, and an RCE issue in Media Framework.
In all, Pixel has 43 security holes, affecting Android runtime, Framework, Media Framework, System, kernel components and Pixel components.
These are: Two EoP issues in Pixel components; an EoP issue in Media Framework and another EoP bug in Framework.
News URL
https://threatpost.com/android-critical-rce-bug/166723/
Related news
- CISA warns critical Geoserver GeoTools RCE flaw is exploited in attacks (source)
- Progress warns of critical RCE bug in Telerik Report Server (source)
- Critical ServiceNow RCE flaws actively exploited to steal credentials (source)
- Progress fixes critical RCE flaw in Telerik Report Server, upgrade ASAP! (CVE-2024-6327) (source)
- Android spyware 'Mandrake' hidden in apps on Google Play since 2022 (source)
- Critical Apache OFBiz pre-auth RCE flaw fixed, update ASAP! (CVE-2024-38856) (source)
- Google fixes Android kernel zero-day exploited in targeted attacks (source)
- Google Patches New Android Kernel Vulnerability Exploited in the Wild (source)
- Google splats device-hijacking exploited-in-the-wild Android kernel bug among others (source)
- Critical Progress WhatsUp RCE flaw now under active exploitation (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-06-21 | CVE-2021-0516 | Use After Free vulnerability in Google Android In p2p_process_prov_disc_req of p2p_pd.c, there is a possible out of bounds read and write due to a use after free. | 7.5 |