The zero-day’s ID is CVE-2024-53104; it relates to privilege escalation in the USB Video Class driver of the Android kernel and enables authenticated local attackers to escalate their privileges.
The vulnerability originates from incorrect parsing of UVC_VS_UNDEFINED type frames in the uvc_parse_format function. As a result, the frames buffer size was calculated incorrectly resulting in out-of-bounds writes, which could be used to execute arbitrary code or deliver denial of service (DoS) attacks.
In addition to the above-mentioned zero-day vulnerability, the February set of patches fixes a critical vulnerability in Qualcomm’s WLAN component. Qualcomm describes this bug (CVE-2024-45569) as follows: memory corruption while parsing the ML IE due to invalid frame content.
CVE-2024-45569 can be used by remote attackers to execute arbitrary code or commands, read or modify memory, or cause crashes. Importantly, these attacks don’t require privileges or user interaction.
In February 2025, Google released two sets of patches: 2025-02-01 and 2025-02-05. The latter one includes all the fixes from the first set, as well as additional fixes for third-party closed-source modules and kernel elements that apply not to all Android devices.