Google fixed Critical Remote Code Execution flaw in Android

Google addressed a critical vulnerability in Android OS, tracked as CVE-2022-20345, that can be exploited to achieve remote code execution over Bluetooth.

Google has fixed a critical vulnerability, tracked as CVE-2022-20345, that affects the Android System component. The IT giant has fixed the flaw with the release of Android 12 and 12L updates.

Google did not disclose additional details about the vulnerability.

“The most severe vulnerability in this section could lead to remote code execution over Bluetooth with no additional execution privileges needed.” reads the security bulletin published by Google.

Google addressed the issue with the release of security patch levels ‘2022-08-01’ and ‘2022-08-05’.

The CVE-2022-20345 flaw is the only issue rated as critical fixed by Google this month.

All the remaining vulnerabilities have been rated as ‘high severity’. The flaws impact Framework, Media Framework, System, Kernel, Imagination Technologies, MediaTek, Unisoc and Qualcomm components.

Google also patched tens of security vulnerabilities in Google Pixel devices, including four critical remote code execution flaws tracked as:

CVEReferencesTypeSeverityComponent

CVE-2022-20237	A-229621649 *	RCE	Critical	Modem
CVE-2022-20400	A-225178325*	RCE	Critical	Modem
CVE-2022-20402	A-218701042 *	RCE	Critical	Modem
CVE-2022-20403	A-207975764 *	RCE	Critical	Modem

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Android)

---