Android patches several vulnerabilities in first security update of 2025
Android has released its first security update of the year, disclosing several critical and high-severity vulnerabilities that affect a wide range of Android devices.
The bulletin identifies five critical remote code execution (RCE) vulnerabilities affecting what Android categorizes as the “system,” which encompasses Android’s core components and underlying architecture. These vulnerabilities could allow attackers to execute code without needing additional privileges. Devices receiving a security patch level dated January 5, 2025, or later are protected from these vulnerabilities.
The vulnerabilities are cataloged as follows:
- CVE-2024-43096
- CVE-2024-43770
- CVE-2024-43771
- CVE-2024-49747
- CVE-2024-49748
Samsung, which uses Android as the operating system on its devices, pushed a patch for these vulnerabilities in a December update.
The vulnerabilities were discovered by researchers at Oppo’s Amber Security Lab. Oppo is a Chinese consumer electronics manufacturer that runs a custom version of Android OS on its devices.
Additionally, the bulletin gives details on vulnerabilities in components from third-party vendors, including MediaTek and Qualcomm.
A component vulnerability in MediaTek’s modem chipset (CVE-2024-20154) can allow data to be written to the wrong place because there’s no check to make sure it stays within safe limits. This problem might allow someone to control the device from afar by tricking it into connecting to a fake cell tower.
One particular Qualcomm vulnerability, cataloged as CVE-2024-21464, arises from a problem in the part of a device that manages data networks and connections. There is an issue when data is being copied without checking if it fits properly into the memory space. This can cause errors in the memory, especially when no active users are connected to the device’s internet capabilities.
Consumers with Google-issued devices, such as the Google Pixel, or Android partners are asked to use these patches promptly and efficiently.
You can read the full bulletin here.
