{"id":114268,"date":"2024-03-12T12:25:57","date_gmt":"2024-03-12T10:25:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-android-14-ekspluatiruemaya-cherez-bluetooth-le"},"modified":"2024-03-12T12:25:57","modified_gmt":"2024-03-12T10:25:57","slug":"uyazvimost-v-android-14-ekspluatiruemaya-cherez-bluetooth-le","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-android-14-ekspluatiruemaya-cherez-bluetooth-le","title":{"rendered":"Vulnerabilit\u0101te Android 14, ko izmanto caur Bluetooth LE","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GrapheneOS projekta izstr\u0101d\u0101t\u0101ji, kas att\u012bsta dro\u0161u AOSP (Android Open Source Project) atzaru, ir identific\u0113ju\u0161i ievainojam\u012bbu Android 14 platformas Bluetooth kompakta, kas potenci\u0101li var izrais\u012bt att\u0101lin\u0101tu koda izpildi. Probl\u0113ma radusies, piek\u013c\u016bstot jau atbr\u012bvotai atmi\u0146as vietai (use-after-free) audio apstr\u0101des kod\u0101, kas tiek p\u0101rs\u016bt\u012bta caur Bluetooth LE. <\/p>\n

Ievainojam\u012bba tika atkl\u0101ta, integr\u0113jot papildu aizsardz\u012bbu zvanu hardened_malloc, kas izmanto ARMv8.5 MTE (MemTag, Memory Tagging Extension) papla\u0161in\u0101jumu, \u013caujot piesaist\u012bt tagus katrai atmi\u0146as izlieto\u0161anas oper\u0101cijai un veikt nor\u0101\u017eu pareiz\u012bbas p\u0101rbaudes, lai nov\u0113rstu ievainojam\u012bbu izmanto\u0161anu, kas saist\u012btas ar piek\u013cuvi jau atbr\u012bvotiem atmi\u0146as blokiem, bufera p\u0101rslodzes gad\u012bjumiem, piek\u013c\u016b\u0161anu pirms inicializ\u0101cijas un izmanto\u0161anu \u0101rpus teko\u0161\u0101 konteksta. <\/p>\n

K\u013c\u016bda izpau\u017eas s\u0101kot ar Android 14 QPR2 (Quarterly Platform Release) atjaunin\u0101jumu, kas tika public\u0113ts marta s\u0101kum\u0101. Android 14 platformas pamatkod\u0101 MTE meh\u0101nisms ir pieejams k\u0101 opcija un pagaid\u0101m netiek izmantots p\u0113c noklus\u0113juma, ta\u010du GrapheneOS to jau ir ieviesusi papildu aizsardz\u012bbai, kas \u013c\u0101va diagnostic\u0113t k\u013c\u016bdu p\u0113c atjaunin\u0101juma uz Android 14 QPR2. K\u013c\u016bda izrais\u012bja av\u0101rijas laik\u0101, izmantojot Bluetooth austi\u0146as Samsung Galaxy Buds2 Pro ar MTE pamata aizsardz\u012bbu. Incidensa anal\u012bze par\u0101d\u012bja, ka probl\u0113ma saist\u012bta ar piek\u013cuvi jau atbr\u012bvotai atmi\u0146ai Bluetooth LE apstr\u0101d\u0113, nevis av\u0101riju, ko izrais\u012bjusi MTE integr\u0101cija. <\/p>\n

Vulnerabilit\u0101te ir nov\u0113rsta GrapheneOS 2024030900 versij\u0101 un skar viedt\u0101lru\u0146u b\u016bves, kur\u0101s nav aktiviz\u0113ta papildu aparat\u016bras aizsardz\u012bba, kas balst\u012bta uz MTE (MTE pa\u0161laik ir aktiviz\u0113ts tikai Pixel 8 un Pixel 8 Pro ier\u012bc\u0113m). Vulnerabilit\u0101te izpau\u017eas Google Pixel 8 viedt\u0101lru\u0146os ar Android 14 QPR2 versiju. Android Pixel 8 s\u0113rijas viedt\u0101lru\u0146os MTE re\u017e\u012bmu var aktiviz\u0113t izstr\u0101d\u0101t\u0101ju opciju iestat\u012bjumos (\"Iestat\u012bjumi \/ Sist\u0113ma \/ Izstr\u0101d\u0101t\u0101ja opcijas \/ Atmi\u0146as mar\u0137\u0113\u0161anas papla\u0161in\u0101jumi\"). MTE aktiviz\u0113\u0161ana palielina atmi\u0146as pat\u0113ri\u0146u aptuveni par 3%, ta\u010du nesamazina veiktsp\u0113ju.
\n
Avots: opennet.lv<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 GrapheneOS, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0435 \u043e\u0442\u0432\u0435\u0442\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0442 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u044b AOSP (Android Open Source Project), \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Bluetooth-\u0441\u0442\u0435\u043a\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android 14, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435\u043c \u043a \u0443\u0436\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0451\u043d\u043d\u043e\u0439 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043f\u0430\u043c\u044f\u0442\u0438 (use-after-free) \u0432 \u043a\u043e\u0434\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0432\u0443\u043a\u0430, \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u0447\u0435\u0440\u0435\u0437 Bluetooth LE. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0432 \u0432\u044b\u0437\u043e\u0432 hardened_malloc \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114268","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Ievainojam\u012bba Android 14, ko izmanto caur Bluetooth LE | ProHoster","description":"GrapheneOS projekta izstr\u0101d\u0101t\u0101ji, kas att\u012bsta dro\u0161u atzaru no AOSP (Android Open Source Project) kodu b\u0101zes, ir atkl\u0101ju\u0161i ievainojam\u012bbu Android 14 platformas Bluetooth stek\u0101, kas potenci\u0101li var novest pie probl\u0113m\u0101m.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-android-14-ekspluatiruemaya-cherez-bluetooth-le","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Android 14, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0447\u0435\u0440\u0435\u0437 Bluetooth LE | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 GrapheneOS, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0435 \u043e\u0442\u0432\u0435\u0442\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0442 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u044b AOSP (Android Open Source Project), \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Bluetooth-\u0441\u0442\u0435\u043a\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android 14, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-android-14-ekspluatiruemaya-cherez-bluetooth-le","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-12T10:25:57+00:00","article:modified_time":"2024-03-12T10:25:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/114268","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=114268"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/114268\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=114268"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=114268"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=114268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}