Google fixes remote escalation of privileges bug on Android

Google has released the February 2022 Android security updates, addressing two critical vulnerabilities, one being a remote escalation of privilege that requires no user interaction.

The vulnerability is tracked as CVE-2021-39675, carrying a “critical” severity rating, and affects only Android 12, the latest version of the popular OS.

These flaws are typically leveraged by sophisticated spyware vendors that independently discover and privately use zero-days in mobile operating systems. However, in this case, Google hasn’t seen any signs of active exploitation.

The second critical flaw addressed by the February 2022 security update is CVE-2021-30317, which affects a closed-source component of Qualcomm, and thus only concerns Android devices that use that vendor’s hardware.

Here’s a summary of this month’s fixes:

• Five high-severity flaws in Framework
• Four high-severity bugs in Media Framework
• Seven high-severity to critical flaws in System
• Two vulnerabilities of undefined severity in Media Provider
• One high-severity flaw in Amlogic components
• Five high-severity bugs in MediaTek components
• Three high-severity flaws in Unisoc components
• Six high to critical-severity vulnerabilities in Qualcomm components

As Google clarifies in the bulletin: "The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are turned off for development purposes or if successfully bypassed."

The technical details about the vulnerabilities are not available at this time, as Android updates typically need several months to reach a respectable percentage of the userbase, given that vendors need to bundle them separately for each device model.

The only exception to this practice is Google’s own Pixel devices, with all models from '3a' up to '6 Pro' already receiving the February 2022 security update in a simultaneous roll-out.

Finally, the fixes that come with this month’s update concern Android 10, 11, and 12, so if your phone runs anything older than that, you are no longer covered, and you should consider your device a security liability.

If you don’t want to replace a perfectly working electronic device that is no longer supported by its manufacturer, you could flash it with a third-party Android ROM that's based on a more recent and secure AOSP version, like LineageOS for example.

Google fixes remote escalation of privileges bug on Android