Federal agencies have been mandated to patch affected systems by April 30, 2025, as these exploits form part of a sophisticated zero-day chain reportedly used to unlock confiscated Android devices. These vulnerabilities are reportedly part of a larger exploit chain including the previously identified CVE-2024-53104 allegedly developed by digital forensics vendor Cellebrite and used by law enforcement agencies to forcibly unlock Android devices. The Cybersecurity and Infrastructure Security Agency (CISA) has added two significant Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog yesterday, confirming both flaws are being actively weaponized in targeted attacks. The vulnerability is addressed in kernel versions 5.15.0-305.176.4.el9uek (Oracle) and 6.12.2. Google’s April 2025 Android security update includes the fix. The affected systems include Linux kernels up to version 6.12.1, particularly those using Extigy and Mbox USB audio devices. Affected systems include Linux kernels from 5.4 to 6.12.1, including Android devices. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Attackers with physical access can exploit it by connecting a malicious USB device, such as a forged audio interface, to trigger out-of-bounds memory accesses. Local attackers with elevated privileges can exploit it to read kernel memory, potentially exposing encryption keys or credentials. The exploits were discovered during a forensic investigation by Amnesty International’s Security Lab while analyzing logs from devices unlocked by Serbian police. Organizations using Linux systems, particularly those with USB peripherals, should apply available patches immediately and consider implementing additional USB device restrictions until systems are fully secured. CVE-2024-53150 specifically can leak memory content from kernel space to user space, potentially exposing encryption keys or credentials. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. A malicious USB device providing a bNumConfigurations value exceeding the initial allocation in usb_get_configuration leads to memory corruption in usb_destroy_configuration. She is covering various cyber security incidents happening in the Cyber Space.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 10 Apr 2025 08:25:10 +0000