Android- Zero Day Vulnerability

Google has disclosed that a now-patched vulnerability affecting Android devices that use Qualcomm chipsets is being weaponized by adversaries to launch targeted attacks. The flaw concerns an "improper input validation" issue in Qualcomm's Graphics component that could be exploited to trigger memory corruption when an attacker-engineered app requests access to a huge chunk of the device's memory.

Affected CVE:  CVE-2020-11261 (CVSS score 8.4)

 

How the exploitation works?

  1. There are indications that CVE-2020-11261 may be under limited, targeted exploitation was mentioned by Google in an updated January security bulletin on March 18.
  2. CVE-2020-11261 was discovered and reported to Qualcomm by Google's Android Security team on July 20, 2020, after which it was fixed in January 2021.
  3. It is worth noting that the access vector for the vulnerability is "local," meaning that exploitation requires local access to the device. In other words, to launch a successful attack, the bad actor must either have physical access to the vulnerable smartphone or use other means - e.g., a watering hole - to deliver malicious code and set off the attack chain.
  4. While specifics about the attacks, the identity of the attacker, and the targeted victims have not been released, it is not unusual for Google to withhold sharing such information to prevent other threat actors from taking advantage of the vulnerability.

Previous exploitations of similar vulnerabilities

  1. In 2020, a severe Qualcomm vulnerability affecting Android was also disclosed. The vulnerability was defined as a collection of over 400 bugs in the embedded Qualcomm chipsets. The core of the issues was a disruption in the DSP processor functions, which caused improper handling of the most important features of the Android device: process execution, charging, and multimedia execution.
  2. Threat actors could the Achilles bug in different distribution campaigns – from directly creating malicious files, to using payload carriers and SPAM email messages.
  3. In 2019, a chain of two security bugs (CVE-2015-6639 and CVE-2016-2431) were discovered in the Qualcomm Secure World virtual processor, which could be exploited to leak financial information.

Remediations:

  1. The 2021-01-01 security patch level also fixes fifteen vulnerabilities in Framework, including a critical denial of service (DoS) flaw, eight high-severity elevation of privilege bugs, four high-severity information disclosure issues, one high-severity DoS flaw, and one medium-severity remote code execution vulnerability.
  2. Patches for nine flaws in Qualcomm closed-source components were also included in this month’s set of updates (two critical and seven high-severity vulnerabilities).
  3. All these issues, as well as vulnerabilities patched with previous Android security updates, are resolved on devices running a security patch level of 2021-01-05 or later.
  4. On Pixel devices, a security patch level of 2021-01-05 also addresses four other vulnerabilities: a high-severity elevation of privilege in Framework and a moderate one in Kernel components, along with a moderate flaw in Qualcomm components and another in Qualcomm closed-source components.