High-Severity Zero-Day Kernel Vulnerability Actively Exploited in Android Devices

This vulnerability, CVE-2024-36971, is a use-after-free flaw in the Linux kernel that Google’s August 2024 Android Security Bulletin says may be under limited, targeted exploitation. The National Vulnerability Database rates it 7.8, which is high severity. Android users should install the August 2024 security patch levels to fix it.

What is the CVE-2024-36971 vulnerability?

Google’s recent Android security updates have revealed a high-severity zero-day vulnerability, CVE-2024-36971, which may be actively exploited in targeted attacks. This flaw, found in the network route management of the Linux kernel, is a use-after-free (UAF) vulnerability that can lead to memory corruption. If successfully exploited, this vulnerability could allow attackers to execute arbitrary code without user interaction, potentially giving them complete control over the affected device. While Google’s bulletin says there are indications that this vulnerability may be under limited, targeted exploitation, specific details about the threat actors and their motivations have not been disclosed.

What did the 2024-08-01 patch level fix?

The 2024-08-01 security patch level addresses 12 high-severity vulnerabilities in the Android Framework, including 10 that could lead to privilege escalation, one that could result in information disclosure and one that could cause a denial of service (DoS). It also fixes one high-severity information disclosure flaw in the System component. CVE-2024-36971 is not in this group: Google lists it under the second patch level. These vulnerabilities pose significant risks, as they could allow attackers to escalate privileges, access sensitive information, or disrupt services on affected devices.

Which Android patch levels should you install?

Furthermore, the 2024-08-05 security patch level includes fixes for 32 vulnerabilities across various components, including Kernel components, Arm components, Imagination Technologies, MediaTek components, Qualcomm components, and Qualcomm closed-source components. Among these, a critical vulnerability (CVE-2024-23350) in Qualcomm closed-source components has been addressed. Android users are strongly urged to apply both the 2024-08-01 and 2024-08-05 security patch levels immediately to mitigate these threats and protect their devices from potential exploitation. Delaying updates could leave users vulnerable to significant security risks, particularly given the active exploitation of CVE-2024-36971.

How does the CVE-2024-36971 flaw work?

The National Vulnerability Database describes a race condition in the kernel function __dst_negative_advice(). The function did not follow the kernel’s RCU rules when it cleared the cached route of a network socket, so another thread could keep using memory that had already been freed. This class of bug, a use-after-free (CWE-416), can corrupt memory, and attackers can steer that corruption towards running their own code. The NVD vector (local access, low privileges, no user interaction) means the attacker first needs a foothold on the phone, for example a malicious app, but does not need the owner to tap anything. The Android bulletin labels the issue as remote code execution in the kernel with High severity.

Which patch level contains the kernel fix?

Read the August 2024 Android Security Bulletin carefully. The kernel fix for CVE-2024-36971 sits in the 2024-08-05 patch level, not in 2024-08-01. A phone that reports only 2024-08-01 has the Framework and System fixes but not this kernel fix. Google also says a device that declares the 2024-08-05 level must include all earlier fixes, so that level is the one to look for. The same level carries the Qualcomm and MediaTek fixes mentioned above.

According to the NVD record, the US cyber agency CISA added the flaw to its Known Exploited Vulnerabilities catalog on 7 August 2024 with a due date of 28 August 2024 for federal agencies. Other organizations can read that as a signal to treat the update as urgent. Google has not named the attackers, and the bulletin only says exploitation may be limited and targeted.

What should Android users and IT teams do?

Individuals should install the latest system update and then confirm the security patch date in the phone settings (the menu name differs by maker). Teams that manage phones should find devices that are stuck on an older patch level, because unsupported models never receive the fix.