An update for devices running Android versions 10, 11 and 12 has been released as two security patch levels: 2022-06-01 and 2022-06-05.  Across these updates over 40 vulnerabilities have been identified and patched, 5 of which have been given a severity rating of ‘Critical’ by the Android security team.  This separation into two security patch levels was to give Android partners more flexibility in fixing the vulnerabilities that are shared across devices more quickly.

In Android’s security bulletin published yesterday they identify CVE-2022-20127, a system vulnerability, as the most severe security issue addressed in this fix. Affecting Android OS 10, 11, 12 and 12L, it can lead to remote code execution with no additional execution privileges needed.  

Other critical system vulnerabilities are CVE-2022-20140, which affects OS 12 and 12L, and CVE-2022-20145, affecting OS 11. These are elevation of privilege vulnerabilities, so typically would be exploited through malware installed via applications, which gain access to data or functions they should not normally be able to access without the rights or privileges gained through the attack.  

A critical vulnerability was also found to affect the media framework on OS 10, 11, 12 and 12L, identified as CVE-2022-20130. This is another remote code execution vulnerability which can be exploited with no additional execution privileges needed. These 4 vulnerabilities are all addressed through the 2022-06-01 patch level. 

The final critical vulnerability addressed is in the 2022-06-05 security patch level, which addressed fixes related to Kernel, MediaTek, Unisoc and Qualcomm closed-source components, unlike 2022-06-01, which focused on source code patches and Google Play system updates. Critical vulnerability CVE-2022-20210 affects the Unisoc modem component. The exploitation of this denial of service vulnerability is described as being able to be launched remotely through the use of a specially crafted packet.  

Android has advised that any devices running the affected operating systems should be updated to the most recent version, using the 2022-06-05 security patch level, as this addresses issues associated with all previous patch levels.