Google Patched Linux Kernel Vulnerability In Android Allows Attackers Gain Write Access

Google has released its February 2025 Android Security Bulletin, which addresses 47 vulnerabilities impacting Android devices.

A notable issue is a patched Linux kernel vulnerability (CVE-2024-53104) that could enable attackers to execute remote code (RCE), granting unauthorized read/write access to affected systems.

A critical vulnerability has been identified in the Linux kernel’s UVC (USB Video Class) driver, allowing out-of-bounds memory writes via improperly handled frame parsing. This could lead to system crashes, privilege escalation, or arbitrary code execution.

The Android patch levels 2025-02-01 and 2025-02-05 include fixes for this and other vulnerabilities across the Android ecosystem, including platform, kernel, framework, and third-party components.

Technical Analysis

The vulnerability arises in the USB Video Class driver during frame parsing. Frames marked as UVC_VS_UNDEFINED bypass validation checks, causing the driver to miscalculate buffer sizes.

Attackers could exploit this by:

1. Inserting a malicious USB device or tampering with video streams.
2. Triggering buffer overflow via malformed frames, overwriting adjacent memory regions.

The vulnerability (CVE-2024-53104) originates in the uvc_parse_format function within drivers/media/usb/uvc/uvc_driver.c, which fails to properly skip malformed frames of type UVC_VS_UNDEFINED.

This leads to incorrect buffer allocation in uvc_parse_streaming, potentially resulting in memory corruption. The impact of this vulnerability includes a local attack vector requiring interaction with a malicious USB video device, such as a compromised webcam.

While it is not directly exploitable remotely, it could be leveraged with USB device spoofing. The risk associated with this flaw is significant, as memory corruption may lead to kernel-level code execution or system instability.

“This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in
uvc_parse_streaming.”

Code Snippet (Simplified):

// Before Fix
for (i = 0; i < nframes; ++i) {
    // Missing check for UVC_VS_UNDEFINED frames  
    frame = &format->frame[i];
    // ... parsing logic ...
}

// After Fix  
for (i = 0; i < nframes; ++i) {
    if (frames[i].bDescriptorSubtype == UVC_VS_UNDEFINED)
        continue;  // Skip invalid frames  
    frame = &format->frame[j++];
}

Affected Kernel Versions

All Linux kernels from 2.6.26 (released July 2008) up to the fixed versions below are vulnerable.

February 2025 Android Security Bulletin:

The February 2025 Android Security Bulletin addressed 47 vulnerabilities across various components, including the Android framework, system, kernel, and vendor-specific drivers like MediaTek, Qualcomm, and Arm. Below is the detailed table of all the vulnerabilities disclosed:

It is strongly recommended that Android users update their devices to security patch levels 2025-02-01 or 2025-02-05 as soon as possible to address the disclosed vulnerabilities.

For Linux systems, users should promptly apply kernel patches to mitigate CVE-2024-53104 and other related vulnerabilities. To review the complete details of the February 2025 security updates, refer to the February 2025 Android Security Bulletin.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free