Google patches Android zero-day vulnerability exploited by hackers

📟 News

Date: 05/02/2025

Google released the February set of patches for Android. In total, they fix 48 bugs, including a kernel zero-day vulnerability actively exploited by hackers.

The zero-day’s ID is CVE-2024-53104; it relates to privilege escalation in the USB Video Class driver of the Android kernel and enables authenticated local attackers to escalate their privileges.

The vulnerability originates from incorrect parsing of UVC_VS_UNDEFINED type frames in the uvc_parse_format function. As a result, the frames buffer size was calculated incorrectly resulting in out-of-bounds writes, which could be used to execute arbitrary code or deliver denial of service (DoS) attacks.

In addition to the above-mentioned zero-day vulnerability, the February set of patches fixes a critical vulnerability in Qualcomm’s WLAN component. Qualcomm describes this bug (CVE-2024-45569) as follows: memory corruption while parsing the ML IE due to invalid frame content.

CVE-2024-45569 can be used by remote attackers to execute arbitrary code or commands, read or modify memory, or cause crashes. Importantly, these attacks don’t require privileges or user interaction.

In February 2025, Google released two sets of patches: 2025-02-01 and 2025-02-05. The latter one includes all the fixes from the first set, as well as additional fixes for third-party closed-source modules and kernel elements that apply not to all Android devices.

Related posts:
2025.01.26 — Cisco patched a critical vulnerability in Meeting Management

Cisco released updates to fix a critical (CVSS score: 9.9) vulnerability in Meeting Management. The bug enables an unprivileged remote authenticated attacker to gain administrative privileges. The vulnerability…

Full article →
2025.02.03 — PyPI introduces a project archival system to combat malicious updates

The Python Package Index (PyPI) introduces a new project archival system: a project can now be archived to notify users that it's not expected to be updated…

Full article →
2025.04.12 — Hackers compromised a bureau within the U.S. Department of the Treasury and spent months in hacked systems

The Office of the Comptroller of the Currency (OCC), an independent bureau within the United States Department of the Treasury, reported a major cybersecurity incident. Unknown attackers had…

Full article →
2025.03.07 — YouTube warns of scam video featuring its CEO

According to YouTube, scammers use an AI-generated video of the company's CEO in phishing attacks to steal user credentials. The scammers attack content creators by sending them…

Full article →
2025.04.07 — Critical RCE vulnerability discovered in Apache Parquet

All versions of Apache Parquet up to and including 1.15.0 are affected by a critical remote code execution (RCE) vulnerability whose CVSS score is 10 out…

Full article →
2025.01.24 — Hundreds of websites impersonating Reddit and WeTransfer spread Lumma Stealer

Sekoia researcher crep1x discovered that hackers are currently using some 1,000 pages impersonating Reddit and WeTransfer. Victims visiting these sites are tricked into…

Full article →
2025.03.20 — 8,000 vulnerabilities identified in WordPress ecosystem in 2024

According to Patchstack, world's #1 WordPress vulnerability intelligence provider, 7,966 new vulnerabilities were identified in the WordPress ecosystem in 2024; most of these bugs affected plugins…

Full article →
2025.04.01 — Hackers abuse MU plugins to inject malicious payloads to WordPress

According to Sucuri, hackers store malicious code in the MU-plugins (Must-Use Plugins) directory in WordPress and execute it while remaining undetected. The technique was first discovered…

Full article →
2025.04.10 — April updates released by Microsoft cause issues with Windows Hello

Microsoft warns that some Windows users who have installed the April updates might be unable to login to their Windows services using Windows Hello facial recognition…

Full article →
2025.03.18 — Black Basta ransomware group developed its own automated brute-forcing framework

According to EclecticIQ, Black Basta Ransomware-as-a-Service (RaaS) group has developed its own automated brute-forcing framework dubbed BRUTED. It's used to hack edge network devices…

Full article →