Android Patchday Dezember 2024: Mehrere Schwachstellen
WID-SEC-2024-3580 · first 03.12.2024 · updated 23.10.2026 · CVSS 8,8
What it is about
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel. Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen oder beliebigen Code auszuführen.
Under what conditions?
Over the network.
What can happen in the worst case
An attacker could use the vulnerability to
- seine Privilegien zu erhöhen oder beliebigen Code auszuführen
Am I affected?
Affected according to the BSI:
- Google Android 12
- Google Android 13
- Lenovo BIOS
- Google Android 14
- Google Android 15
- Google Android 12L
- SUSE Linux
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Install the updates provided by the vendor; details in the sources below.
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- Lenovo Security Advisory LEN-180503 vom 2024-12-10 support.lenovo.com
- Android Patchday December 2024 vom 2024-12-02 source.android.com
- SUSE Security Update SUSE-SU-2026:4858-1 vom 2026-10-22 lists.suse.com
CVE: CVE-2024-20125, CVE-2024-33044, CVE-2024-33056, CVE-2024-33063, CVE-2024-43048, CVE-2024-43052, CVE-2024-43077, CVE-2024-43097, CVE-2024-43701, CVE-2024-43762, CVE-2024-43764, CVE-2024-43767, CVE-2024-43768, CVE-2024-43769
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.