Android flaw CVE-2024-43093 may be under limited, targeted exploitation

Google warned that a vulnerability, tracked as CVE-2024-43093, in the Android OS is actively exploited in the wild.

Threat actors are actively exploiting a vulnerability, tracked as CVE-2024-43093, in the Android OS, Google warns.

The vulnerability is a privilege escalation issue in the Android Framework component. Successful exploitation of the vulnerability could lead to unauthorized access to “Android/data,” “Android/obb,” and “Android/sandbox” directories and associated sub-directories.

Google as usual did not share details about the attacks exploiting the above vulnerability, however, it added that another issue, tracked as CVE-2024-43047, is actively exploited in the wild.

“There are indications that the following may be under limited, targeted exploitation.

• CVE-2024-43093
• CVE-2024-43047″ reads the security bulletin published by Google.

The vulnerability CVE-2024-43047 is a kernel issue in the Qualcomm components. The issue is a potential use-after-free (UAF) vulnerability in the way the DSP (Digital Signal Processor) handles Direct Memory Access (DMA) file descriptors (FDs) in its header buffers. Successful exploitation can lead to memory corruption.

Both vulnerabilities are under limited, targeted exploitation, Google states.

In September, Google addressed a high-severity vulnerability, tracked as CVE-2024-32896 (CVSS score: 7.8), in its Android operating system under active exploitation in the wild.

The vulnerability CVE-2024-32896 is a privilege escalation in the Android Framework component.

“there is a possible way to bypass due to a logic error in the code.” reads the advisory published by NIST National Vulnerability Database (NVD). “This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Google)