Google on Monday published a security bulletin describing the latest round of patches for the Android operating system. Three dozen vulnerabilities have been fixed, including a critical issue that can be exploited for remote code execution over Bluetooth.
The critical vulnerability is tracked as CVE-2022-20345 and it affects the System component. It has been patched with Android 12 and 12L updates.
According to Google, an attacker does not require additional execution privileges to remotely execute arbitrary code over a Bluetooth attack. No additional details are available about the vulnerability.
The remaining security bugs have all been assigned a ‘high severity’ rating. They impact components such as Framework, Media Framework, System, Kernel, Imagination Technologies, MediaTek, Unisoc and Qualcomm components. Many of them can lead to privilege escalation or information disclosure.
Fixes for these flaws are included in the security patch levels ‘2022-08-01’ and ‘2022-08-05’. Google releases two patch levels to provide its partners the flexibility to fix a subset of vulnerabilities that are similar across all devices more quickly. However, the tech giant advises partners to use the latest security patch level and bundle all fixes in a single update.
In its Pixel devices, Google patched 40 security holes, including four critical remote code execution issues affecting the modem component. Three of the weaknesses, which can lead to privilege escalation or information disclosure, are rated ‘high severity’, while the rest have been assigned a ‘moderate severity’ rating.
Samsung has also released updates for its flagship models to patch the Android vulnerabilities, as well as 20 flaws discovered in its own devices.
Related: 44 Vulnerabilities Patched in Android With April 2022 Security Updates
Related: Microsoft Finds Major Security Flaws in Pre-Installed Android Apps
Related: Google Patches Critical Android Vulnerabilities With June 2022 Updates