{"id":148495,"date":"2025-11-15T23:11:59","date_gmt":"2025-11-15T21:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uzvimost-v-bluetooth-steke-platformy-android"},"modified":"2025-11-15T23:11:59","modified_gmt":"2025-11-15T21:11:59","slug":"udalyonno-ekspluatiruemaya-uzvimost-v-bluetooth-steke-platformy-android","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uzvimost-v-bluetooth-steke-platformy-android","title":{"rendered":"Vulnerabilit\u00e0 remote nel stack Bluetooth della piattaforma Android","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nel bollettino di sicurezza di novembre di Android \u00e8 stata pubblicata un'informazione riguardante la vulnerabilit\u00e0 CVE-2025-48593 nel sottosistema Bluetooth, che colpisce le versioni di Android dalla 13 alla 16. Questa vulnerabilit\u00e0 \u00e8 stata classificata con un livello critico di pericolo (9.8 su 10) poich\u00e9 pu\u00f2 portare all'esecuzione remota di codice durante l'elaborazione di pacchetti Bluetooth appositamente formati. <\/p>\n

Google non ha ancora fornito una descrizione dettagliata della vulnerabilit\u00e0, ma i ricercatori indipendenti affermano che il problema non colpisce i normali smartphone e riguarda solo dispositivi Bluetooth in grado di fungere da altoparlanti, come colonne sonore intelligenti, smartwatch e sistemi di infotainment per auto. Per sfruttare la vulnerabilit\u00e0, \u00e8 necessario che l'utente associasse il proprio dispositivo con quello dell'attaccante, il che significa che per bloccare il problema \u00e8 sufficiente non accettare richieste di associazione sospette (nel bollettino di Google si menziona che per sfruttare la vulnerabilit\u00e0 non \u00e8 richiesto alcun intervento da parte dell'utente). <\/p>\n

La correzione consiste nell'aggiungere una chiamata per verificare l'esistenza del Discovery Database durante l'uso del profilo Bluetooth Handsfree e fermare la ricerca dei peer utilizzando il protocollo SDP (Service Discovery Protocol), oltre a ripristinare e pulire la struttura p_disc_db (\u00abdiscovery database\u00bb). Sono state effettuate specifiche operazioni per restituire errori e ripristinare connessioni durante l'individuazione del servizio Bluetooth e la negoziazione dell'interazione. server<\/a> La correzione \u00e8 gi\u00e0 stata integrata nel codice sorgente di LineageOS. \u00c8 disponibile un prototipo iniziale di exploit che provoca un crash all'avvio di Android in un emulatore speciale. Sono state inoltre registrate nel network tentativi di vendita di exploit funzionanti, ma sembrano essere tentativi di diffusione di malware o vendite truffaldine da parte di malintenzionati. <\/p>\n

L'exploit ha gi\u00e0 causato una chiusura anomala durante l'avvio in un emulatore specifico. Sono stati riscontrati tentativi di commerci di exploit funzionanti nel web, ma sembrano essere tentativi di diffusione di malware o vendite fraudolente da parte di truffatori. <\/p>\n

Oltre a questa vulnerabilit\u00e0, l'aggiornamento di novembre di Android include una correzione per la vulnerabilit\u00e0 CVE-2025-48581, che porta all'innalzamento dei privilegi. Il problema interessa solo Android 16 ed \u00e8 classificato come pericoloso. La causa della vulnerabilit\u00e0 \u00e8 un errore logico nella funzione VerifyNoOverlapInSessions del file apexd.cpp, che consente di bloccare l'installazione di aggiornamenti che risolvono problemi di sicurezza. Si segnala che la vulnerabilit\u00e0 pu\u00f2 essere utilizzata per un incremento locale dei privilegi. Non sono necessarie azioni da parte dell'utente per eseguire l'attacco.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043d\u043e\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u043c \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Android \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2025-48593 \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Bluetooth, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0440\u0441\u0438\u0438 Android \u0441 13 \u043f\u043e 16. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.8 \u0438\u0437 10) \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 Bluetooth-\u043f\u0430\u043a\u0435\u0442\u043e\u0432. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043f\u043e\u043a\u0430 \u043d\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043d\u043e \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0442, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-148495","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilit\u00e0 sfruttabile da remoto nel stack Bluetooth della piattaforma Android | ProHoster","description":"Nel bollettino di sicurezza di novembre di Android \u00e8 stata pubblicata informazioni sulla vulnerabilit\u00e0 CVE-2025-48593 nel sottosistema Bluetooth, che colpisce le versioni di Android dalla 13 alla 16. A questa vulnerabilit\u00e0 \u00e8 stato assegnato un livello critico di pericolo (9.8 su 10) in quanto pu\u00f2 portare all'esecuzione remota di codice durante l'elaborazione di pacchetti Bluetooth appositamente formattati. Google al momento non fornisce una descrizione dettagliata della vulnerabilit\u00e0, ma i ricercatori indipendenti affermano.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uzvimost-v-bluetooth-steke-platformy-android","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0443\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Bluetooth-\u0441\u0442\u0435\u043a\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android | ProHoster","og:description":"\u0412 \u043d\u043e\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u043c \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Android \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2025-48593 \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Bluetooth, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0440\u0441\u0438\u0438 Android \u0441 13 \u043f\u043e 16. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.8 \u0438\u0437 10) \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 Bluetooth-\u043f\u0430\u043a\u0435\u0442\u043e\u0432. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043f\u043e\u043a\u0430 \u043d\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043d\u043e \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0442,","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uzvimost-v-bluetooth-steke-platformy-android","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-11-15T21:11:59+00:00","article:modified_time":"2025-11-15T21:11:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"148495","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:55:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 15:59:20","updated":"2026-02-22 15:55:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/148495","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=148495"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/148495\/revisions"}],"predecessor-version":[{"id":162519,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/148495\/revisions\/162519"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=148495"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=148495"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=148495"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}