Check Point achọpụtala adịghị ike na ALAC (Apple Lossless Audio Codec) decoders audio format decoders nyere MediaTek (CVE-2021-0674, CVE-2021-0675) na Qualcomm (CVE-2021-30351). Nsogbu a na-enye ohere ka e gbuo koodu onye na-awakpo mgbe ị na-ahazi data ahaziri ahazi na usoro ALAC.
Ihe ize ndụ nke adịghị ike na-akawanye njọ site n'eziokwu na ọ na-emetụta ngwaọrụ ndị na-agba ọsọ na ikpo okwu gam akporo nke nwere MediaTek na Qualcomm ibe. N'ihi mwakpo ahụ, onye na-awakpo nwere ike ịhazi ogbugbu malware na ngwaọrụ nwere ohere ịnweta nkwukọrịta onye ọrụ na data multimedia, gụnyere data sitere na igwefoto. A na-eme atụmatụ na 2/3 nke ndị ọrụ ekwentị niile dabere na ikpo okwu gam akporo na-emetụta nsogbu ahụ. Dịka ọmụmaatụ, na US, ngụkọta oke nke ekwentị ekwentị gam akporo niile rere na nkeji anọ nke 4 nke ejiri MediaTek na ibe Qualcomm butere bụ 2021% (95.1% - MediaTek, 48.1% - Qualcomm).
Ekwuputabeghị nkọwapụta nke nrigbu adịghị ike, mana a na-akọ na MediaTek na Qualcomm components maka ikpo okwu gam akporo na Disemba 2021. Otu akụkọ nke Disemba banyere adịghị ike na ikpo okwu gam akporo kọwara nsogbu ndị ahụ dị ka adịghị ike dị na akụrụngwa nke Qualcomm ibe. Ekwupụtaghị adịghị ike dị na akụrụngwa MediaTek na akụkọ ahụ.
Ihe ọghọm na-adọrọ mmasị n'ihi mgbọrọgwụ ya. Na 2011, Apple meghere koodu iyi nke codec ALAC, nke na-enye ohere mkpakọ nke data ọdịyo na-enweghị ọdịda nke mma, n'okpuru ikike Apache 2.0, ma mee ka o kwe omume iji ikike niile metụtara codec. E bipụtara koodu ahụ mana echekwaghị ya ma agbanwebeghị ya kemgbe afọ 11 gara aga. N'otu oge ahụ, Apple gara n'ihu na-akwado iche iche mmejuputa a na-eji na nyiwe ya, gụnyere iwepụ njehie na adịghị ike na ya. MediaTek na Qualcomm dabere na mmejuputa codec ALAC ha na koodu isi mmalite mepere emepe nke Apple, mana etinyeghị ọghọm ndị akọwapụtara na mmejuputa Apple na patches ha.
Enweghị ozi ma gbasara adịghị ike dị na koodu ngwaahịa ndị ọzọ na-ejikwa koodu ALAC emechiela. Dịka ọmụmaatụ, akwadoro usoro ALAC kemgbe FFmpeg 1.1, mana a na-edobe koodu nwere mmejuputa ihe ndozi.
isi: opennet.ru