Full Report
Google’s monthly batch of security fixes addressed 43 vulnerabilities. The post Android security update contains 2 actively exploited vulnerabilities appeared first on CyberScoop.
Analysis Summary
# Vulnerability: Actively Exploited Flaws in Android March 2025 Security Update
## CVE Details
- CVE ID: CVE-2024-43093, CVE-2024-50302 (and others addressed in the bulletin)
- CVSS Score: 7.8 (for CVE-2024-43093, Severity: High/Critical depending on context)
- CWE: Not explicitly listed in the provided text.
## Affected Systems
- Products: Android devices
- Versions: Devices receiving the March 2025 Android security update. Specific vulnerable versions are not detailed, but the update addresses flaws across Android System, Android Framework, Kernel, MediaTek, and Qualcomm components.
- Configurations: Not specified beyond typical Android configurations.
## Vulnerability Description
Google's March 2025 security update addressed 43 vulnerabilities. Two specific flaws, **CVE-2024-43093** and **CVE-2024-50302**, were noted as potentially under "limited, targeted exploitation." CVE-2024-43093 is described as an **Android framework privilege escalation vulnerability** that allows an attacker to gain local privilege escalation without needing prior execution privileges, but it **requires user interaction** for exploitation. The overall update includes fixes for high-severity and critical-severity vulnerabilities, some of which could lead to Remote Code Execution (RCE).
## Exploitation
- Status: **CVE-2024-43093** and **CVE-2024-50302** are reported to be under **limited, targeted exploitation**. CVE-2024-43093 was added to CISA's Known Exploited Vulnerabilities catalog in November (implying exploitation predates the official March 2025 patch release).
- Complexity: Low complexity is implied for successful exploitation given the "limited, targeted exploitation" notice, although CVE-2024-43093 explicitly requires user interaction.
- Attack Vector: Local (for privilege escalation flaws like CVE-2024-43093), though other unlisted critical flaws potentially allow Network-based RCE.
## Impact
- Confidentiality: Undetermined (Implied moderate to high based on privilege escalation potential).
- Integrity: Undetermined (Implied moderate to high).
- Availability: Undetermined.
## Remediation
### Patches
The March 2025 Android Security Bulletin provides two patch levels:
- **2025-03-01**
- **2025-03-05** (This patch level includes fixes for kernel, MediaTek, and Qualcomm component vulnerabilities).
Source code patches were released to the Android Open Source Project (AOSP) repository.
### Workarounds
No specific workarounds were mentioned in the provided text. Immediate patching is implied as the required mitigation.
## Detection
- Indicators of Compromise (IOCs): Not detailed based on the provided article snippet.
- Detection methods and tools: Not detailed, but general exploitation targeting these flaws should be monitored via endpoint detection and response (EDR) systems capable of tracing local privilege escalation attempts within the Android framework.
## References
- Vendor Advisories: Google's [March security update](https://source.android.com/docs/security/bulletin/2025-03-01)
- Relevant links:
- [CVE-2024-43093 NVD link](https://nvd.nist.gov/vuln/detail/CVE-2024-43093)
- [CVE-2024-50302 NVD link](https://nvd.nist.gov/vuln/detail/CVE-2024-50302)