Google warns Android users of a kernel flaw under attack

Google has released its February Android security updates, including a fix for a high-severity kernel-level vulnerability, which is suspected to be in use by targeted exploits. The flaw, CVE-2024-53104, is an intriguing Linux kernel flaw in its USB video-class driver code. There's not a lot of detail about the bug, other than the fix is to skip the parsing of undefined video frames that would otherwise cause the kernel to write to memory it's not supposed to, which could be used to crash or fully hijack a device. What's interesting is that this driver code is supposed to mainly handle USB cameras and similar video sources. Thus, exploitation potentially involves connecting some malicious hardware that feeds bad data into the system. Google indicated the flaw can be used to achieve "physical escalation of privilege with no additional execution privileges needed," which to us sounds like someone being able to plug a malicious gadget – perhaps something law enforcement might use – into a vulnerable Android device and taking it over. Very curious. CVE-2024-53104 may be under limited, targeted exploitation "There are indications that CVE-2024-53104 may be under limited, targeted exploitation," Google said in its advisory. We note that a patch to address the hole in the open source kernel was accepted at the end of last year. Of the 46 patches pushed out by Google this month, only one is rated as "critical" by the ad slinger: CVE-2024-45569, with a CVSS rating of 9.8 out of 10. The...