Forbes is warning us that Android phones are under severe risk due to a kernel vulnerability:
https://www.forbes.com/sites/zakdoffman/2025/02/03/google-warns-all-android-users-your-phone-is-now-at-risk/
This comes from Google's Android security bulletin for February:
https://source.android.com/docs/security/bulletin/2025-02-01
...which informs us that "There are indications that CVE-2024-53104 may be under limited, targeted exploitation". The vulnerability in question, though, is CVE-2024-53104:
https://lwn.net/ml/all/2024120232-CVE-2024-53104-d781@gregkh
...which is in the uvcvideo camera driver. Either I'm missing something badly, or the only way to exploit this would be to plug a malicious camera device into the phone. I can see why they would want to fix this, but I'm not sure it's a red-alert situation for most of us?
Jonathan Corbet
npub1gu…kcl6w
2025-02-03 21:04:53 UTC
Author Public Key
npub1guyhrdgjzw3fl4esdazyzf8dg0h2dg7hp043wqpw9egl0ds5ydnsckcl6wSeen on
wss://relay.momostr.pinkPublished at
2025-02-03 21:04:53 UTCEvent JSON
{
"id": "56160fc69c6252c62abb3af064d9bb06e263898d5e415b41c450a7389d62316c",
"pubkey": "470971b51213a29fd7306f444124ed43eea6a3d70beb17002e2e51f7b6142367",
"created_at": 1738616693,
"kind": 1,
"tags": [
[
"proxy",
"https://social.kernel.org/objects/f6cfb1d5-b487-472a-897d-8c7799cb1dd2",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://social.kernel.org/objects/f6cfb1d5-b487-472a-897d-8c7799cb1dd2",
"pink.momostr"
],
[
"-"
]
],
"content": "Forbes is warning us that Android phones are under severe risk due to a kernel vulnerability:\r\n\r\nhttps://www.forbes.com/sites/zakdoffman/2025/02/03/google-warns-all-android-users-your-phone-is-now-at-risk/\r\n\r\nThis comes from Google's Android security bulletin for February:\r\n\r\nhttps://source.android.com/docs/security/bulletin/2025-02-01\r\n\r\n...which informs us that \"There are indications that CVE-2024-53104 may be under limited, targeted exploitation\". The vulnerability in question, though, is CVE-2024-53104:\r\n\r\nhttps://lwn.net/ml/all/2024120232-CVE-2024-53104-d781@gregkh\r\n\r\n...which is in the uvcvideo camera driver. Either I'm missing something badly, or the only way to exploit this would be to plug a malicious camera device into the phone. I can see why they would want to fix this, but I'm not sure it's a red-alert situation for most of us?",
"sig": "d1bd2666afc5066511da66e613d6da3061c845558146cbc6ba0486eccf220fc70c9f41bd472b6fd78663f8e9b42a247de7ac75454dd3f105e26fb0971df1b45a"
}