# MA-1115.082024: MyCERT Advisory - Exploited RCE Vulnerability in Android

**Date:** 10 Aug 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1115.082024  
**Advisory ID:** MA-1115.082024

---

**1.0 Introduction**
A recently exploited Remote Code Execution (RCE) vulnerability has been identified in the Android operating system. This vulnerability, tracked as **CVE-2024-36971**, allows malicious actors to execute arbitrary code on affected devices remotely. The flaw primarily resides within the Android kernel, posing significant risks as it enables attackers to potentially take full control of compromised devices.
**2.0 Impact**
The impact of this vulnerability is severe, as it allows attackers to gain unauthorized access to affected Android devices without user interaction, execute arbitrary code that could lead to data theft, device manipulation, or further system compromise, and compromise device integrity could be used as a gateway to introduce malware, ransomware, or spyware onto the device, compromising the integrity and confidentiality of data.
**3.0 Affected Systems**
- Devices running older versions of the Android operating system that have not been updated with the latest security patches.
- Devices that have not received the necessary kernel updates.
**4.0 Recommendations**
CyberSecurity Malaysia encourages users and administrators to review [Android Security Bulletin](https://source.android.com/docs/security/bulletin) for more information and apply the necessary updates.
Kindly refer to the following URLs for more information:
- <https://source.android.com/docs/security/bulletin/2024-08-01>
Generally, CyberSecurity Malaysia advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact us through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 08:30 -17:30 MYT 
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
- <https://source.android.com/docs/security/bulletin/2024-08-01>
- <https://www.malwarebytes.com/blog/news/2024/08/android-vulnerability-used-in-targeted-attacks-patched-by-google>
- <https://www.cisa.gov/news-events/alerts/2024/08/07/cisa-adds-two-known-exploited-vulnerabilities-catalog>
- <https://www.theregister.com/2024/08/06/google_fixes_linux_kernal_rce/>
- <https://source.android.com/docs/security/bulletin>