Check Point tau txheeb xyuas qhov tsis zoo hauv ALAC (Apple Lossless Audio Codec) audio compression format decoders muab los ntawm MediaTek (CVE-2021-0674, CVE-2021-0675) thiab Qualcomm (CVE-2021-30351). Qhov teeb meem tso cai rau tus neeg tawm tsam code raug tua thaum ua cov ntaub ntawv tshwj xeeb formatted hauv ALAC hom.
Qhov txaus ntshai ntawm qhov tsis zoo yog qhov hnyav dua los ntawm qhov tseeb tias nws cuam tshuam rau cov khoom siv khiav hauv Android platform nruab nrog MediaTek thiab Qualcomm chips. Raws li qhov tshwm sim ntawm kev tawm tsam, tus neeg tawm tsam tuaj yeem teeb tsa kev tua malware ntawm lub cuab yeej uas muaj kev nkag mus rau cov neeg siv kev sib txuas lus thiab cov ntaub ntawv multimedia, suav nrog cov ntaub ntawv los ntawm lub koob yees duab. Nws kwv yees tias 2/3 ntawm tag nrho cov neeg siv smartphone raws li Android platform cuam tshuam los ntawm qhov teeb meem. Piv txwv li, nyob rau hauv Teb Chaws Asmeskas, tag nrho feem ntawm tag nrho cov Android smartphones muag nyob rau hauv lub quarter thib ob ntawm 4 uas xa nrog MediaTek thiab Qualcomm chips yog 2021% (95.1% - MediaTek, 48.1% - Qualcomm).
Cov ntsiab lus ntawm kev ua haujlwm ntawm qhov tsis zoo tseem tsis tau tshaj tawm, tab sis nws tau tshaj tawm tias MediaTek thiab Qualcomm cov khoom siv rau Android platform tau patched thaum Lub Kaum Ob Hlis 2021. Daim ntawv tshaj tawm Lub Kaum Ob Hlis Ntuj txog qhov tsis zoo hauv Android platform tau txheeb xyuas cov teeb meem uas yog qhov tsis muaj peev xwm tseem ceeb hauv cov khoom ntiag tug rau Qualcomm chips. Qhov tsis zoo hauv MediaTek cov khoom tsis tau hais hauv cov lus ceeb toom.
Vulnerability yog nthuav vim nws cov hauv paus hniav. Hauv xyoo 2011, Apple tau qhib qhov chaws ntawm ALAC codec, uas tso cai rau compression ntawm cov ntaub ntawv suab yam tsis muaj kev poob zoo, raws li Apache 2.0 daim ntawv tso cai, thiab ua kom nws siv tau tag nrho cov patents ntsig txog lub codec. Txoj cai tau tshaj tawm tab sis sab laug tsis tu thiab tsis tau hloov pauv rau 11 xyoo dhau los. Nyob rau tib lub sijhawm, Apple txuas ntxiv cais kev txhawb nqa kev siv hauv nws lub platform, suav nrog kev tshem tawm qhov tsis raug thiab qhov tsis zoo hauv nws. MediaTek thiab Qualcomm raws li lawv ALAC codec kev siv ntawm Apple tus thawj qhib qhov chaws, tab sis tsis suav nrog qhov tsis zoo uas hais hauv Apple qhov kev siv hauv lawv thaj ua rau thaj.
Tseem tsis tau muaj cov ntaub ntawv hais txog qhov tsis zoo hauv cov cai ntawm lwm cov khoom lag luam uas tseem siv cov lej ALAC uas dhau los. Piv txwv li, ALAC hom ntawv tau txais kev txhawb nqa txij li FFmpeg 1.1, tab sis cov cai nrog kev siv decoder tau ua haujlwm zoo.
Tau qhov twg los: opennet.ru