A critical vulnerability , dubbed Zygote Injection (CVE-2024-31317), allows attackers to execute arbitrary code with system privileges.
See also: Telegram's EvilVideo vulnerability allows malicious code execution
The Zygote Injection vulnerability affects devices running Android 11 or earlier and allows attackers to escalate privileges from a shell user to a system user, potentially compromising entire devices.
The Zygote Injection vulnerability has been described by security researchers as possibly the most “valuable” Android userspace vulnerability in recent years. It targets Android’s Zygote process, a critical component in the operating system responsible for launching new applications and system processes.
When an Android device boots up, after initializing the Linux kernel, it launches core Android services, including the Zygote process, which runs with system privileges. This makes Zygote an attractive target for attackers seeking increased access to Android devices.
See also: Cisco: Vulnerability in Webex for BroadWorks puts credentials at risk
Security researchers at Infosec have discovered that Android's global hidden_api_blacklist_exemptions setting , which allows some apps to bypass Android's hidden API restrictions, can be manipulated to insert malicious commands.
The system server component does not properly escape newline characters when passing commands to the Zygote process, creating a critical Injection vulnerability.
This is because the system server is called whenever the hidden_api_blacklist_exemptions setting changes and passes that setting directly to Zygote without proper sanitization.
The exploit requires the WRITE_SECURE_SETTINGS, which is available in the ADB shell and some pre-installed system applications.
While unprivileged applications cannot change this setting, security researchers have demonstrated that when a malicious actor modifies the hidden_api_blacklist_exemptions setting with inserted newlines, they can add arbitrary Zygote commands that the system treats as legitimate commands for process creation.
See also: CISA added Linux kernel vulnerability to KEV List
An Android vulnerability, such as Zygote Injection, refers to a flaw or weakness in the operating system , applications, or underlying components that could be exploited by attackers to compromise the security, privacy, or functionality of an Android device. These vulnerabilities can exist in various parts of the Android ecosystem, including the operating system, device hardware, applications, and app stores. Exploiting these flaws can lead to a variety of attacks, including data theft, hijacking , and malware installation. Therefore, keeping your system and applications up to date and adhering to security best practices is crucial to protecting Android devices from vulnerabilities.
Source: cybersecuritynews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
