Security Experts:

Google Patches Critical Android Flaw Allowing Remote Code Execution via Bluetooth

Google on Monday published a security bulletin describing the latest round of patches for the Android operating system. Three dozen vulnerabilities have been fixed, including a critical issue that can be exploited for remote code execution over Bluetooth.

The critical vulnerability is tracked as CVE-2022-20345 and it affects the System component. It has been patched with Android 12 and 12L updates.

According to Google, an attacker does not require additional execution privileges to remotely execute arbitrary code over a Bluetooth attack. No additional details are available about the vulnerability.

The remaining security bugs have all been assigned a ‘high severity’ rating. They impact components such as Framework, Media Framework, System, Kernel, Imagination Technologies, MediaTek, Unisoc and Qualcomm components. Many of them can lead to privilege escalation or information disclosure.

Fixes for these flaws are included in the security patch levels ‘2022-08-01’ and ‘2022-08-05’. Google releases two patch levels to provide its partners the flexibility to fix a subset of vulnerabilities that are similar across all devices more quickly. However, the tech giant advises partners to use the latest security patch level and bundle all fixes in a single update.

In its Pixel devices, Google patched 40 security holes, including four critical remote code execution issues affecting the modem component. Three of the weaknesses, which can lead to privilege escalation or information disclosure, are rated ‘high severity’, while the rest have been assigned a ‘moderate severity’ rating.

Samsung has also released updates for its flagship models to patch the Android vulnerabilities, as well as 20 flaws discovered in its own devices.

Related: 44 Vulnerabilities Patched in Android With April 2022 Security Updates

Related: Microsoft Finds Major Security Flaws in Pre-Installed Android Apps

Related: Google Patches Critical Android Vulnerabilities With June 2022 Updates

view counter
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.