Google Patches Over a Dozen High-Severity Privilege Escalation Flaws in Android

Google this week published its Android security bulletin for February 2021, which includes information on more than 40 vulnerabilities, most of which could lead to elevation of privilege.

The first part of the monthly update, which arrives on devices as the 2021-02-01 security patch level, includes fixes for a total of 20 vulnerabilities, 15 of which lead to elevation of privilege.

The most important of these vulnerabilities is a critical flaw in the Media Framework component that could allow an attacker to execute arbitrary code on a vulnerable device. The attacker needs to supply a specially crafted file to trigger the bug.

Tracked as CVE-2021-0325, the issue is considered critical on Android 8.1 and 9 platform releases, but has only a high severity rating on Android 10 and 11, Google’s advisory explains.

Two other flaws patched in Media Framework this month, namely CVE-2021-0332 and CVE-2021-0335, were rated high severity. The bugs could lead to elevation of privilege and information disclosure, respectively.

Google also patched an information disclosure flaw in Android runtime, along with nine elevation of privilege and one denial of service issue in Framework, all of which were rated high severity.

The System component received patches for six vulnerabilities, namely one critical remote code execution bug and five high-severity elevation of privilege issues. One vulnerability was patched in the media codecs component.

The second part of this month’s security update, which is delivered to devices as the 2021-02-05 security patch level, includes patches for 23 vulnerabilities in Kernel components (one high-severity bug), Qualcomm components (one critical and five high-severity flaws), and Qualcomm closed-source components (two critical and fourteen high-severity issues).

A single patch was included in this month’s Pixel update bulletin, for a moderate-severity vulnerability (CVE-2020-11203) in Qualcomm closed-source components.

Pixel devices, Google explains, will receive patches for all the security vulnerabilities in the February 2021 Android security bulletin, and for the bug described in the Pixel update bulletin.

There are no reports that the vulnerabilities addressed in this month’s Android security bulletin are being exploited in the wild, the Multi-State Information Sharing and Analysis Center (MS-ISAC) says.

Related: Google Releases January 2021 Security Updates for Android

Related: December 2020 Android Updates Patch 46 Vulnerabilities

Related: Google Patches 30 Vulnerabilities With November 2020 Android Updates