"Google Patches Critical Android Flaw Allowing Remote Code Execution via Bluetooth"
Google recently published a security bulletin describing the latest round of patches for the Android operating system. Three dozen vulnerabilities have been fixed, including a critical issue that can be exploited for remote code execution over Bluetooth. The critical vulnerability (CVE-2022-20345) affects the System component. It has been patched with Android 12 and 12L updates. Google stated that attackers do not require additional execution privileges to remotely execute arbitrary code over a Bluetooth attack. The remaining vulnerabilities have all been assigned a "high severity" rating. They impact components such as Framework, Media Framework, System, Kernel, Imagination Technologies, MediaTek, Unisoc, and Qualcomm components. Google noted that many of them can lead to privilege escalation or information disclosure. Fixes for these flaws are included in the security patch levels "2022-08-01" and "2022-08-05". Google advises partners to use the latest security patch level and bundle all fixes in a single update. Google patched 40 security holes in its Pixel devices, including four critical remote code execution issues affecting the modem component. Three of the vulnerabilities, which can lead to privilege escalation or information disclosure, are rated "high severity," while the rest have been assigned a "moderate severity" rating. Samsung has also recently released updates for its flagship models to patch the Android vulnerabilities and 20 flaws discovered in its own devices.