Android 's September 2023 security updates address 33 vulnerabilities, including a zero-day bug that is already being used to carry out attacks.
This zero-day vulnerability (CVE-2023-35674) is very serious, as it is a bug in the Android Framework that allows attackers to gain more privileges on the device, without requiring user interaction or additional execution rights.
According to Google, there is evidence that CVE-2023-35674 is being used in targeted attacks.
“Exploiting many issues in Android becomes more difficult with improvements in newer versions of the platform . We encourage all users to update their device to the latest version of Android, where possible,” the company says.
See also: Xbox September Update: What changes does it bring?
In addition to the zero-day vulnerability, September's Android security updates also address three other important bugs in the Android System component and one in Qualcomm closed-source components.
The three vulnerabilities in the System component (CVE-2023-35658, CVE-2023-35673, CVE-2023-35681) can lead to remote code execution (RCE), without requiring additional execution privileges or user interaction.
According to BleepingComputer, the fourth bug (CVE-2023-28581) is described by Qualcomm as a “WLAN Firmware memory corruption” issue, which could allow remote attackers to execute code, read sensitive information, or trigger system errors in attacks that require no privileges or user interaction.
Android security updates: Two levels
As usual, Google released two sets of Android updates for September 2023 (security patch level 2023-09-01 and security patch level 2023-09-05).
The second update level includes all security patches in the initial set and additional updates for third-party closed source and Kernel components that may not be relevant to all Android devices.
See also: VisionOS: New beta version for developers will be released on the App Store
Your Android device vendor may choose to prioritize the initial update rollout to expedite the update process. This does not necessarily imply an increased risk of exploitation.
Aside from Google Pixel devices , which receive security updates immediately each month, other vendors will take a while to push them to their devices . This is because it takes time to test and configure patches for each hardware configuration.
Android security updates for September 2023 target versions 11, 12, and 13.
Those using Android 10 and earlier should consider upgrading to devices running a supported version.
See also: Android kills background apps: How to stop it?
Android security updates are crucial to protecting devices from potential attacks and vulnerabilities. These updates fix and address threats identified by Google and the security. Updates should be applied regularly, as criminals and hackers are constantly discovering and exploiting new vulnerabilities. The update process is usually automatic, but users can also check for and install any available security updates through their device's operating system settings.
Source: www.bleepingcomputer.com
