Google fixed two actively exploited Pixel vulnerabilities

Google addressed several vulnerabilities in Android and Pixel devices, including two actively exploited flaws.

Google addressed 28 vulnerabilities in Android and 25 flaws in Pixel devices. Two issues fixed by the IT giant, tracked as CVE-2024-29745 and CVE-2024-29748, are actively exploited in the wild.

The most critical flaw addressed by the company impacts the System component, it is a local privilege escalation that doesn’t require any additional execution privileges.

“The most severe of these issues is a high security vulnerability in the System component that could lead to local escalation of privilege with no additional execution privileges needed.” reads the Android Security Bulletin—April 2024.

“There are indications that the following may be under limited, targeted exploitation.” reads the advisory.

• CVE-2024-29745
• CVE-2024-29748″

The company did not provide details about the attacks, but in the past such kind of bugs was actively exploited by nation-state actors or commercial spyware vendors.

CVE-2024-29745 is a High severity Information disclosure issue in the bootloader, while CVE-2024-29748 is a High severity elevation of privilege issues in the Pixel Firmware.

The 2024-04-01 security patch level addressed eight high-severity flaws in Framework and System. Addressed issues includes elevation of privileges, information leak, and denial-of-service flaw.

The 2024-04-05 security patch level addressed 20 vulnerabilities in MediaTek, Widevine, and Qualcomm components.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Android)