Google’s latest monthly security updates address 46 new software vulnerabilities, with three identified as actively exploited in targeted attacks.
One of the vulnerabilities tracked as CVE-2023-26083 is a memory leak flaw that affects the Arm Mali GPU driver for Bifrost, Avalon, and Valhall chips. Notably, this vulnerability was previously exploited in an attack that facilitated spyware infiltration on Samsung devices in December 2022, reported The Hacker News.
Due to its severity, the Cybersecurity and Infrastructure Security Agency (CISA) issued a patch order for federal agencies in April 2023.
Another significant vulnerability, CVE-2021-29256, is a high-severity issue that impacts specific versions of the Bifrost and Midgard Arm Mali GPU kernel drivers. Exploiting this flaw allows an unauthorised user to access sensitive data and escalate privileges to the root level.
The third exploit vulnerability, CVE-2023-2136, is a critical-severity bug found in Skia, Google’s open-source multi-platform 2D graphics library. Initially disclosed as a zero-day vulnerability in the Chrome browser, this flaw enables a remote attacker who has taken control of the renderer process to execute a sandbox escape and implement remote code on Android devices.
In addition to these actively exploited vulnerabilities, Google’s July Android security bulletin highlights another critical vulnerability, CVE-2023-21250. This flaw affects the Android system component and can lead to remote code execution without user interaction or additional execution privileges.
The security updates are being rolled out in two patch levels. The first patch level, released on July 1, focuses on core Android components, addressing 22 security defects in the Framework and System components.
The second patch level, released later, targets kernel and closed-source components, addressing 20 vulnerabilities in Kernel, Arm, Imagination Technologies, MediaTek, and Qualcomm components.
It’s important to note that these vulnerabilities may extend beyond the supported Android versions (11,12 and 13), potentially affecting older OS versions that no longer receive official support.
Moreover, Google has released specific security patches for its Pixel devices, addressing 14 vulnerabilities in Kernel, Pixel, and Qualcomm components. Two of these critical weaknesses can potentially result in the privilege elevation of denial-of-service attacks.
In the News: Sega pulls back from blockchain gaming
