One of the zero-days, a high-severity privilege escalation security vulnerability (CVE-2024-53197) in the Linux kernel's USB-audio driver for ALSA Devices, was reportedly exploited by Serbian authorities to unlock confiscated Android devices as part of a zero-day exploit chain developed by Israeli digital forensics company Cellebrite. This exploit chain—which also included a USB Video Class zero-day (CVE-2024-53104) patched in February and a Human Interface Devices zero-day (CVE-2024-50302) patched last month)—was discovered by Amnesty International's Security Lab in mid-2024 while analyzing logs found on devices unlocked by Serbian police. In November 2024, Google also fixed another Android zero-day (CVE-2024-43047), first tagged as exploited by Google Project Zero in October 2024 and used by the Serbian government in NoviSpy spyware attacks against Android devices belonging to activists, journalists, and protestors. Google has released patches for 62 vulnerabilities in Android's April 2025 security update, including two zero-days exploited in targeted attacks. Google Pixel devices receive these updates immediately, while other vendors often take longer to test and fine-tune the security patches for their specific hardware configurations. The March 2025 Android security updates also patch 60 other security vulnerabilities, most of which are high-severity elevation of privilege flaws.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Mon, 07 Apr 2025 18:00:13 +0000