Η Google was released the monthly updates security for Android with fixes for 39 bugs, including one vulnerability zero-day which the company said is currently being used in limited, targeted attacks.
The vulnerability is described in CVE-2021-1048, and is a zero-day (use-after-free vulnerability in the kernel) that can be exploited to escalate local privileges. This bug is dangerous, as it could allow a malicious user to access or reference memory after it has been freed, leading to a "write-what-where" condition that leads to implementation malicious code to gain control of a system.
"There is evidence that CVE-2021-1048 is already in limited use," the company said, without disclosing technical details about the vulnerability or identity of the attackers.
Google Security Update also fixes two critical Remote Code Execution (RCE) vulnerabilities (CVE-2021-0918 and CVE-2021-0930) in the System component that could allow remote attackers to run malicious code as part of a privileged process with sending a specially constructed command.
