Security News > 2023 > May > New Android updates fix kernel bug exploited in spyware attacks
Roid security updates released this month patch a high-severity vulnerability exploited as a zero-day to install commercial spyware on compromised devices.
According to a Google Threat Analysis Group report published in March, it was exploited as part of a complex chain of multiple 0-days and n-days in a spyware campaign targeting Samsung Android phones.
Google TAG linked the attacks to Spanish mercenary spyware vendor Variston, known for its Heliconia exploit framework that targets the Windows platform.
One day after Google TAG published its report, the Cybersecurity and Infrastructure Security Agency added CVE-2023-0266 to the Known Exploited Vulnerabilities, a list of security vulnerabilities actively exploited in attacks.
CISA gave Federal Civilian Executive Branch Agencies agencies three weeks, until April 20, to secure all vulnerable Android devices against attacks that could target the bug.
The May Android updates also address dozens of other security bugs, most high-severity privilege escalation issues in the OS and various components.
News URL
Related news
- Lazarus Hackers Exploited Windows Kernel Flaw as Zero-Day in Recent Attacks (source)
- 'eXotic Visit' Spyware Campaign Targets Android Users in India and Pakistan (source)
- Apple Updates Spyware Alert System to Warn Victims of Mercenary Attacks (source)
- Apple: Mercenary spyware attacks target iPhone users in 92 countries (source)
- Apple stops warning of 'state-sponsored' attacks, now alerts about 'mercenary spyware' (source)
- Apple Alerts iPhone Users in 92 Countries to Mercenary Spyware Attacks (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-01-30 | CVE-2023-0266 | Use After Free vulnerability in Linux Kernel A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. | 7.8 |