Pierluigi Paganini January 06, 2021

Google released an Android security update that addressed tens of flaws, including a critical Android remote code execution vulnerability.

Google released an Android security update that addresses 43 flaws, including a critical remote code execution vulnerability in the Android System component tracked as CVE-2021-0316. Google addressed the flaws with the release of Security patch levels of 2021-01-05 or later.

“The most severe of these issues is a critical security vulnerability in the System component that could enable a remote attacker using a specially crafted transmission to execute arbitrary code within the context of a privileged process.” reads Google’s January Android security bulletin.

The bulletin also fixed a critical DoS vulnerability, tracked as CVE-2021-0313, that affects the Framework. The flaw could be exploited by a remote attacker using a specially crafted transmission to execute arbitrary code within the context of a privileged process.

The above vulnerabilities affect Android versions 8.0, 8.1, 9, 10 and 11.

Source code patches for these vulnerabilities have been released to the Android Open Source Project (AOSP) repository.

Google also addressed other 2 critical flaws in the Qualcomm closed-source components tracked as CVE-2020-11134 and CVE-2020-11182.

Google also fixed the following high-severity vulnerabilities:

• Framework: CVE-2021-0303, CVE-2021-0306, CVE-2021-0307,CVE-2021-0310, CVE-2021-0315, CVE-2021-0317, CVE-2021-0318, CVE-2021-0319, CVE-2021-0304, CVE-2021-0309, CVE-2021-0321, CVE-2021-0322, CVE-2019-9376;
• Media Framework: CVE-2021-0311, CVE-2021-0312; CVE-2021-0308, CVE-2021-0320;
• System: CVE-2020-0471;
• Kernel components: CVE-2020-10732, CVE-2020-10766, CVE-2021-0323;
• MediaTek components: CVE-2021-0301;
• Qualcomm components: CVE-2020-11233, CVE-2020-11239, CVE-2020-11220, CVE-2020-11250, CVE-2020-11261, CVE-2020-11262;
• Qualcomm closed-source components: CVE-2020-11126, CVE-2020-11126, CVE-2020-11159, CVE-2020-11181, CVE-2020-11235, CVE-2020-11238, CVE-2020-11241, CVE-2020-11260.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Pierluigi Paganini

(SecurityAffairs – hacking, Google)

[adrotate banner=”5″]

[adrotate banner=”13″]