On September 3, 2024, Google released the Android Security Bulletin for September, which identified several critical vulnerabilities affecting Android devices.
This update addresses security issues discovered in various components of the Android operating system, such as the Framework, System, and Kernel, as well as vulnerabilities affecting hardware components from Qualcomm, ARM, and others.
The bulletin contains two major security patches: 2024-09-01 and 2024-09-05.
Users should install the latest updates as soon as possible to reduce the risk of exploitation.
Devices running Android 10 or later will receive both security and Google Play system updates, which will help to reduce risks even further.
The Framework component is affected by the most critical vulnerability detailed in this month's bulletin.
This vulnerability, identified as CVE-2024-32896, could allow an attacker to gain elevated privileges on an Android device without requiring any special permissions.
This means that if the vulnerability is successfully exploited, the attacker may gain control of the device, potentially resulting in data theft or system manipulation.
Other similar vulnerabilities were discovered in the System component, with the potential for privilege escalation.
In addition, other vulnerabilities in the framework, such as CVE-2024-40658 and CVE-2024-40662, were identified as high risk due to their similar ability to enable privilege escalation.
Multiple critical vulnerabilities were discovered in the System component. These include CVE-2024-40650, CVE-2024-40652, and CVE-2024-40655, all of which could enable an attacker to escalate privileges on the system.
These vulnerabilities pose a serious threat because attackers could gain unauthorized access to critical parts of the system, resulting in significant security breaches.
Another critical issue addressed by Google Play System Updates was CVE-2024-40659, a Remote Key Provisioning vulnerability.
The bug was fixed using Project Mainline, a system that delivers critical updates directly to Android devices via Google Play.
This process enables faster fixes to critical vulnerabilities, ensuring that even devices not running the most recent version of Android are still protected from threats.
In addition to the framework and system components, critical vulnerabilities were discovered in the kernel and hardware components, particularly on devices powered by Qualcomm, ARM, Imagination Technologies, and Unisoc.
Notably, vulnerabilities CVE-2024-33042 and CVE-2024-33052 impacted Qualcomm's WLAN component, posing a risk of remote code execution if exploited.