CERT-In Alert: Multiple Vulnerabilities in Android Impacting Millions of Devices

Overview

The Computer Emergency Response Team of India (CERT-In) has issued an urgent vulnerability note (CIVN-2024-0349) regarding multiple security flaws in Android. These vulnerabilities, identified as “High” in severity, affect Android versions 12, 12L, 13, 14, and 15, potentially putting millions of devices worldwide at risk.

This advisory serves as a wake-up call for OEMs (Original Equipment Manufacturers), Android users, and cybersecurity professionals. If exploited, the vulnerabilities could lead to unauthorized data access, privilege escalation, arbitrary code execution, and system crashes.

Overview of the Threats

Android is the world’s most widely used mobile operating system. It powers billions of devices globally, including smartphones, tablets, smartwatches, and IoT devices. Its open-source nature and vast ecosystem make it a prime target for attackers.

CERT-In has highlighted that multiple vulnerabilities have been detected in various critical components of Android, including:

• Framework
• System
• Google Play System Updates
• Kernel and Kernel LTS
• Chipset Components: MediaTek, Qualcomm, Imagination Technologies
• Closed-Source Qualcomm Components

The exploitation of these vulnerabilities could allow threat actors to:

• Extract sensitive information such as user credentials and private data.
• Gain elevated privileges, enabling unauthorized control over the device.
• Execute arbitrary code, leading to malware installation or unauthorized actions.
• Cause Denial of Service (DoS), rendering the device unstable or inoperable.

Implications for Users and OEMs

Risk Assessment

The vulnerabilities have been classified as High Risk, indicating significant potential for widespread damage:

• Unauthorized Access: Attackers could exploit the flaws to infiltrate devices and access sensitive user data.
• System Instability: Successful exploitation might cause devices to crash or malfunction, disrupting regular operations.

Impact Assessment

• Data Breaches: Private user data could be exposed or stolen, posing privacy and financial risks.
• System Downtime: Affected devices could experience crashes, slowing down productivity and service availability.

This situation demands immediate attention from OEMs, who must release timely patches, and from users, who must ensure their devices remain updated.

The Scope of the Vulnerabilities

The CERT-In advisory lists over 40 vulnerabilities tracked under the Common Vulnerabilities and Exposures (CVE) system. A few of the critical CVEs include:

• CVE-2023-35659
• CVE-2024-20104
• CVE-2024-21455
• CVE-2024-38402
• CVE-2024-43093

Each CVE points to a specific flaw in Android’s components. For instance, vulnerabilities in Qualcomm and MediaTek chipsets could allow remote attackers to bypass critical security controls. Kernel vulnerabilities could enable privilege escalation, granting attackers complete control over the device.

Recommended Actions

For Users

1. Update Your Device: Check for system updates regularly and apply them as soon as they become available. OEMs release patches to mitigate these vulnerabilities.
2. Download Apps Only from Trusted Sources: Avoid third-party app stores and download apps exclusively from Google Play.
3. Enable Security Features: Utilize features like biometric authentication, two-factor authentication (2FA), and device encryption.
4. Avoid Clicking Suspicious Links: Phishing attacks often exploit such vulnerabilities to compromise devices.

For OEMs and Enterprises

1. Prioritize Patch Management: Ensure timely delivery of security patches to devices running vulnerable Android versions.
2. Conduct Risk Assessments: Evaluate the potential impact of these vulnerabilities on your devices and systems.
3. Collaborate with Google: Work closely with Google to address vulnerabilities and maintain the integrity of Google Play system updates.
4. Communicate with Users: Inform customers about the risks and provide clear instructions on applying updates.

Technical Analysis: Why These Flaws Matter

The vulnerabilities stem from diverse sources, including outdated software components, misconfigurations, and unpatched exploits. Here’s a breakdown:

1. Framework and System Flaws: These are at the core of Android and may enable attackers to access sensitive OS-level permissions.
2. Kernel and Kernel LTS Issues: Kernel vulnerabilities are particularly dangerous as they grant low-level access, making privilege escalation easier.
3. Chipset-Specific Weaknesses: Vulnerabilities in MediaTek and Qualcomm components highlight how third-party hardware can introduce risks into Android devices.
4. Google Play Updates: An attacker exploiting flaws in Google Play system updates can compromise the very mechanism meant to secure devices.

Attackers typically exploit these flaws via:

• Remote Code Execution (RCE): Delivering malicious payloads through apps or websites.
• Privilege Escalation: Gaining unauthorized control of devices.
• Denial of Service (DoS): Overloading system resources to render the device inoperable.

Looking Ahead: The Role of Collaborative Efforts

The CERT-In advisory emphasizes the need for collaboration among stakeholders, including Google, OEMs, and the cybersecurity community. A comprehensive approach involving timely patching, user education, and proactive risk management is essential to mitigate these risks.

Key Takeaways

1. Android versions 12 through 15 are vulnerable to multiple high-severity security flaws.
2. The vulnerabilities could lead to data theft, privilege escalation, or denial of service.
3. Users must apply updates promptly and exercise caution while browsing or installing apps.
4. OEMs should expedite patch rollouts to ensure device security.

Even a single unpatched vulnerability can cascade into large-scale cyber incidents. Staying vigilant and acting swiftly is the only way to ensure Android devices remain safe from exploitation.

References

https://www.cert-in.org.in