Android Issues Patches for 4 New Zero-Day Bugs Exploited in the Wild

Google on Wednesday updated its May 2021 Android Security
Bulletin to disclose that four of the security vulnerabilities that
were patched earlier this month by Arm and Qualcomm may have been
exploited in the wild as zero-days.

“There are indications that CVE-2021-1905, CVE-2021-1906,
CVE-2021-28663 and CVE-2021-28664 may be under limited, targeted
exploitation,” the search giant said^[1]
in an updated alert.

The four flaws impact Qualcomm Graphics^[2]
and Arm Mali GPU Driver^[3]
modules —

• CVE-2021-1905 (CVSS score: 8.4) – A
  use-after-free flaw in Qualcomm’s graphics component due to
  improper handling of memory mapping of multiple processes
  simultaneously.
• CVE-2021-1906 (CVSS score: 6.2) – A flaw
  concerning inadequate handling of address deregistration that could
  lead to new GPU address allocation failure.
• CVE-2021-28663 (CVSS score: NA) – A
  vulnerability in Arm Mali GPU kernel that could permit a
  non-privileged user to make improper operations on GPU memory,
  leading to a use-after-free scenario that could be exploited to
  gain root privilege or disclose information.
• CVE-2021-28664 (CVSS score: NA) – An
  unprivileged user can achieve read/write access to read-only
  memory, enabling privilege escalation or a denial-of-service (DoS)
  condition due to memory corruption.

Successful exploitation of the weaknesses could grant an
adversary carte blanche access to the targeted device and take over
control. It’s, however, not clear how the attacks themselves were
carried out, the victims that may have been targeted, or the threat
actors that may be abusing them.

The development marks one of the rare instances where zero-day
bugs in Android have been spotted in real-world cyber
offensives.

Earlier this March, Google revealed that a vulnerability
affecting Android devices that use Qualcomm chipsets (CVE-2020-11261^[4]) was being weaponized by
adversaries to launch targeted attacks. The other flaw is CVE-2019-2215^[5], a vulnerability in
Binder^[6]
— Android’s inter-process communication mechanism — that’s said to
have been allegedly exploited by the NSO Group as well as SideWinder threat actor^[7]
to compromise a victim’s device and collect user information.