V\u00fdzkumn\u00edci z t\u00fdmu Google Project Zero podrobn\u011b analyzovali techniku, jak vytvo\u0159it funk\u010dn\u00ed exploit, kter\u00fd umo\u017e\u0148uje vzd\u00e1len\u00e9 spu\u0161t\u011bn\u00ed vlastn\u00edho k\u00f3du s pr\u00e1vem j\u00e1dra Linuxu prost\u0159ednictv\u00edm zasl\u00e1n\u00ed SMS nebo RCS zpr\u00e1vy se speci\u00e1ln\u011b upraven\u00fdm zvukov\u00fdm p\u0159\u00edlohou. \u00datok prob\u00edh\u00e1 bez proveden\u00ed jak\u00fdchkoli akc\u00ed u\u017eivatelem, v\u010detn\u011b nutnosti prohl\u00ed\u017eet nebo poslouchat p\u0159ijatou zpr\u00e1vu. <\/p>\n
V exploitu jsou zapojeny dv\u011b zranitelnosti: v knihovn\u011b Dolby Unified Decoder (CVE-2025-54957) a ovlada\u010di bigwave pro j\u00e1dro Linuxu (CVE-2025-36934). D\u0159\u00edve bylo pro vyu\u017eit\u00ed zranitelnost\u00ed v kodec\u00edch nutn\u00e9, aby u\u017eivatel poslechl nebo prohl\u00e9dl p\u0159ijat\u00fd \u0161kodliv\u00fd obsah. Po integraci AI pomocn\u00edk\u016f v posledn\u00edch verz\u00edch Androidu se p\u0159ijat\u00fd multimedi\u00e1ln\u00ed obsah automaticky dek\u00f3duje po p\u0159\u00edjmu, co\u017e v\u00fdrazn\u011b zvy\u0161uje \u00fato\u010dnou plochu, kter\u00e1 nevy\u017eaduje \u017e\u00e1dn\u00e9 akce od u\u017eivatele (0-click). V kontextu zvukov\u00fdch zpr\u00e1v SMS a RCS aplikace Google Messages pomoc\u00ed slu\u017eby com.google.android.tts automaticky vytv\u00e1\u0159\u00ed transkripce pro pou\u017eit\u00ed na zvukov\u00fdch zpr\u00e1v\u00e1ch vyhled\u00e1v\u00e1n\u00ed textu, co\u017e umo\u017e\u0148uje bez \u00fa\u010dasti u\u017eivatele zneu\u017e\u00edvat zranitelnosti v existuj\u00edc\u00edch zvukov\u00fdch kodec\u00edch. <\/p>\n
Probl\u00e9m v Dolby Unified Decoder je zp\u016fsoben celo\u010d\u00edseln\u00fdm p\u0159ete\u010den\u00edm p\u0159i v\u00fdpo\u010dtu velikosti vyrovn\u00e1vac\u00ed pam\u011bti pro zpracov\u00e1van\u00e9 datov\u00e9 struktury syncframe, co\u017e m\u016f\u017ee b\u00fdt vyu\u017eito k z\u00e1pisu mimo vyhrazenou pam\u011b\u0165. V d\u016fsledku p\u0159ete\u010den\u00ed m\u016f\u017ee b\u00fdt p\u0159eps\u00e1n ukazatel pou\u017e\u00edvan\u00fd p\u0159i zpracov\u00e1n\u00ed n\u00e1sleduj\u00edc\u00edho synchroniza\u010dn\u00edho sn\u00edmku, jeho\u017e zm\u011bna pak umo\u017e\u0148uje p\u0159epsat ukazatel na funkci kontrolovan\u00fdmi \u00fato\u010dn\u00edkem daty a iniciovat spu\u0161t\u011bn\u00ed vlastn\u00edho k\u00f3du s pr\u00e1vy \u201emediacodec\u201c, omezen\u00fdmi prost\u0159ednictv\u00edm SELinuxu. <\/p>\n
K exploataci j\u00e1dra Linux byla vyu\u017eita zranitelnost v ovlada\u010di bigwave, kter\u00fd zaji\u0161\u0165uje pr\u00e1ci s symbolick\u00fdm za\u0159\u00edzen\u00edm \/dev\/bigwave, k n\u011bmu\u017e byl zp\u0159\u00edstupn\u011bn p\u0159\u00edstup z kontextu SELinux \u201emediacodec\u201c. Zranitelnost umo\u017enila p\u0159epsat struktury j\u00e1dra prost\u0159ednictv\u00edm manipulac\u00ed s ioctl vol\u00e1n\u00edm BIGO_IOCX_PROCESS a dos\u00e1hnout tak spu\u0161t\u011bn\u00ed k\u00f3du s pr\u00e1vy j\u00e1dra. <\/p>\n
Zranitelnost v knihovn\u011b Dolby Unified Decoder (libcodec2_soft_ddpdec.so), kter\u00e1 poskytuje funkce pro dek\u00f3dov\u00e1n\u00ed form\u00e1t\u016f Dolby Digital (DD, AC-3) a Dolby Digital Plus (DD+, EAC-3), nen\u00ed specifick\u00e1 pro Android a firmwary Pixel 9, ale objevuje se tak\u00e9 na jin\u00fdch platform\u00e1ch (Samsung S24, MacBook Air M1, iPhone 17 Pro, Windows, ChromeOS atd.). V repozit\u00e1\u0159i AOSP pro Android a ve firmwaru Samsung S24 je na procesy spu\u0161t\u011bn\u00e9 v kontextu mediacodec aplikov\u00e1n seccomp filtr syst\u00e9mov\u00fdch vol\u00e1n\u00ed, kter\u00fd zt\u011b\u017euje dal\u0161\u00ed zneu\u017eit\u00ed zranitelnost\u00ed v j\u00e1d\u0159e. Ve firmwaru pro Pixel 9 tento filtr chyb\u011bl. \u00fatoky by mohl chr\u00e1nit<\/a> Mechanismus Memory Tagging (MTE) je k dispozici pouze pro za\u0159\u00edzen\u00ed Pixel 8+ jako volba aktivovan\u00e1 p\u0159i zapnut\u00ed re\u017eimu \u201ePokro\u010dil\u00e9 zabezpe\u010den\u00ed\u201c. V macOS a iOS komplikuje exploataci kompilace knihovny s p\u0159ep\u00edna\u010dem \u201e-fbounds-safet\u201c, kter\u00fd vkl\u00e1d\u00e1 dal\u0161\u00ed kontroly v\u00fdstupu za hranice pol\u00ed, co\u017e sni\u017euje v\u00fdkon. <\/p>\n V\u00fdzkumn\u00edci se samostatn\u011b zab\u00fdvaj\u00ed probl\u00e9my s distribuc\u00ed opravy zranitelnosti v Dolby Unified Decoder u\u017eivatel\u016fm. Informace o zranitelnosti byly zve\u0159ejn\u011bny ve\u0159ejn\u011b 82 dn\u00ed p\u0159ed t\u00edm, ne\u017e byla oprava k dispozici u\u017eivatel\u016fm za\u0159\u00edzen\u00ed Pixel. Spole\u010dnost Dolby byla o probl\u00e9mu informov\u00e1na 26. \u010dervna 2025. Prvn\u00ed bin\u00e1rn\u00ed oprava byla vyd\u00e1na 18. z\u00e1\u0159\u00ed pro ChromeOS, ale pro za\u0159\u00edzen\u00ed Android poskytla spole\u010dnost Dolby bin\u00e1rn\u00ed patche a\u017e 8. \u0159\u00edjna. Dne 15. \u0159\u00edjna byly ve\u0159ejn\u011b odhaleny informace o zranitelnosti. 12. listopadu vydal opravu Samsung a teprve 5. ledna byla publikov\u00e1na oprava pro za\u0159\u00edzen\u00ed Pixel. Distribuce patche pro v\u0161echna za\u0159\u00edzen\u00ed s Androidem trvala 139 dn\u00ed. <\/p>\n Zranitelnost v Dolby Unified Decoder byla odhalena za m\u00e9n\u011b ne\u017e dva dny, zat\u00edmco u ovlada\u010de BigWave byla zrecenzov\u00e1na za m\u00e9n\u011b ne\u017e den. Pracovn\u00ed n\u00e1klady na v\u00fdvoj funk\u010dn\u00edho exploitu pro zranitelnost v Dolby Unified Decoder byly odhadnuty na 8 t\u00fddn\u016f jednoho v\u00fdzkumn\u00edka, zat\u00edmco pro BigWave na 3 t\u00fddny. V publikovan\u00e9 zpr\u00e1v\u011b spole\u010dnosti Dolby ze 14. \u0159\u00edjna byla zranitelnost v Dolby Unified Decoder ozna\u010dena jako n\u00edzk\u00e1 \u00farove\u0148 nebezpe\u010d\u00ed, navzdory p\u0159ed\u00e1n\u00ed podrobnost\u00ed o vyv\u00edjen\u00e9m exploitu. Zranitelnosti v BigWave byly v syst\u00e9mu Android p\u0159id\u011bleny st\u0159edn\u00ed \u00farove\u0148 nebezpe\u010d\u00ed (Moderate), co\u017e bylo od\u016fvodn\u011bno t\u00edm, \u017ee \u00fatok je mo\u017en\u00fd pouze z privilegovan\u00e9ho obsahu a nen\u00ed dostupn\u00fd pro neprivilegovan\u00e9 kontexty (po t\u0159ech m\u011bs\u00edc\u00edch byla zm\u011bn\u011bna klasifikace zranitelnosti na \u201enebezpe\u010dn\u00fd probl\u00e9m\u201c). \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b\u0438 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u044f\u0434\u0440\u0430 Linux, \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 SMS- \u0438\u043b\u0438 RCS-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0432\u0443\u043a\u043e\u0432\u044b\u043c \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \u0410\u0442\u0430\u043a\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0431\u0435\u0437 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430 \u0438\u043b\u0438 \u043f\u0440\u043e\u0441\u043b\u0443\u0448\u0438\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f. \u0412 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0435 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-153878","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v Android firmwaru, kter\u00e1 umo\u017e\u0148uje spu\u0161t\u011bn\u00ed k\u00f3du prost\u0159ednictv\u00edm zasl\u00e1n\u00ed zpr\u00e1vy | ProHoster","description":"V\u00fdzkumn\u00edci z t\u00fdmu Google Project Zero podrobn\u011b prozkoumali techniku vytv\u00e1\u0159en\u00ed funk\u010dn\u00edho exploit, kter\u00fd umo\u017e\u0148uje vzd\u00e1len\u00e9 spu\u0161t\u011bn\u00ed vlastn\u00edho k\u00f3du s pr\u00e1vy j\u00e1dra Linux prost\u0159ednictv\u00edm odesl\u00e1n\u00ed SMS nebo RCS zpr\u00e1vy se speci\u00e1ln\u011b navr\u017een\u00fdm obsahem.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-android-proshivke-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-soobshheniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Android-\u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b\u0438 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u044f\u0434\u0440\u0430 Linux, \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 SMS- \u0438\u043b\u0438 RCS-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-android-proshivke-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-soobshheniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-01-17T09:12:33+00:00","article:modified_time":"2026-01-17T09:12:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"153878","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 15:57:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-20 14:13:19","updated":"2026-01-24 15:57:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/153878","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=153878"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/153878\/revisions"}],"predecessor-version":[{"id":154931,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/153878\/revisions\/154931"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=153878"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=153878"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=153878"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"