{"id":114268,"date":"2024-03-12T12:25:57","date_gmt":"2024-03-12T10:25:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-android-14-ekspluatiruemaya-cherez-bluetooth-le"},"modified":"2024-03-12T12:25:57","modified_gmt":"2024-03-12T10:25:57","slug":"uyazvimost-v-android-14-ekspluatiruemaya-cherez-bluetooth-le","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-android-14-ekspluatiruemaya-cherez-bluetooth-le","title":{"rendered":"Vulnerabilidade no Android 14, explorada via Bluetooth LE","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Os desenvolvedores do projeto GrapheneOS, que desenvolve uma ramifica\u00e7\u00e3o segura da base de c\u00f3digo AOSP (Android Open Source Project), identificaram uma vulnerabilidade na pilha Bluetooth da plataforma Android 14, que pode potencialmente levar \u00e0 execu\u00e7\u00e3o remota de c\u00f3digo. O problema \u00e9 causado pelo acesso a uma \u00e1rea de mem\u00f3ria j\u00e1 liberada (use-after-free) no c\u00f3digo de processamento de \u00e1udio transmitido via Bluetooth LE. <\/p>\n

A vulnerabilidade foi identificada devido \u00e0 integra\u00e7\u00e3o de defesa adicional na chamada hardened_malloc, utilizando a extens\u00e3o ARMv8.5 MTE (MemTag, Memory Tagging Extension), que permite vincular etiquetas a cada opera\u00e7\u00e3o de aloca\u00e7\u00e3o de mem\u00f3ria e organizar a verifica\u00e7\u00e3o da corre\u00e7\u00e3o do uso de ponteiros para bloquear a explora\u00e7\u00e3o de vulnerabilidades causadas pelo acesso a blocos de mem\u00f3ria j\u00e1 liberados, estouros de buffer, acessos antes da inicializa\u00e7\u00e3o e uso fora do contexto atual. <\/p>\n

O erro se manifesta a partir da atualiza\u00e7\u00e3o Android 14 QPR2 (Quarterly Platform Release), lan\u00e7ada no in\u00edcio de mar\u00e7o. Na base de c\u00f3digo principal da plataforma Android 14, o mecanismo MTE est\u00e1 dispon\u00edvel como uma op\u00e7\u00e3o e ainda n\u00e3o \u00e9 aplicado por padr\u00e3o, mas no GrapheneOS j\u00e1 foi utilizado para prote\u00e7\u00e3o adicional, o que possibilitou diagnosticar o erro ap\u00f3s a atualiza\u00e7\u00e3o para Android 14 QPR2. O erro causava falhas ao usar fones de ouvido Bluetooth Samsung Galaxy Buds2 Pro com firmware que ativava a prote\u00e7\u00e3o baseada em MTE. A an\u00e1lise do incidente mostrou que o problema estava relacionado ao acesso \u00e0 mem\u00f3ria j\u00e1 liberada no manipulador Bluetooth LE, e n\u00e3o a uma falha devido \u00e0 integra\u00e7\u00e3o do MTE. <\/p>\n

A vulnerabilidade foi corrigida na vers\u00e3o GrapheneOS 2024030900 e afeta compila\u00e7\u00f5es para smartphones que n\u00e3o possuem a prote\u00e7\u00e3o de hardware adicional baseada na extens\u00e3o MTE (MTE atualmente est\u00e1 ativado apenas para dispositivos Pixel 8 e Pixel 8 Pro). A vulnerabilidade pode ser reproduzida em smartphones Google Pixel 8 com firmware baseado no Android 14 QPR2. No Android para smartphones da s\u00e9rie Pixel 8, o modo MTE pode ser ativado nas op\u00e7\u00f5es de desenvolvedor (\"Configura\u00e7\u00f5es \/ Sistema \/ Op\u00e7\u00f5es de desenvolvedor \/ Extens\u00f5es de Marca\u00e7\u00e3o de Mem\u00f3ria\"). A ativa\u00e7\u00e3o do MTE resulta em um aumento do consumo de mem\u00f3ria de cerca de 3%, mas n\u00e3o reduz o desempenho.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 GrapheneOS, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0435 \u043e\u0442\u0432\u0435\u0442\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0442 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u044b AOSP (Android Open Source Project), \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Bluetooth-\u0441\u0442\u0435\u043a\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android 14, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435\u043c \u043a \u0443\u0436\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0451\u043d\u043d\u043e\u0439 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043f\u0430\u043c\u044f\u0442\u0438 (use-after-free) \u0432 \u043a\u043e\u0434\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0432\u0443\u043a\u0430, \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u0447\u0435\u0440\u0435\u0437 Bluetooth LE. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0432 \u0432\u044b\u0437\u043e\u0432 hardened_malloc \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114268","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilidade no Android 14 explorada via Bluetooth LE | ProHoster","description":"Os desenvolvedores do projeto GrapheneOS, que est\u00e1 desenvolvendo um desvio seguro da base de c\u00f3digo do AOSP (Android Open Source Project), identificaram uma vulnerabilidade na pilha Bluetooth da plataforma Android 14, que pode potencialmente levar a...","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-android-14-ekspluatiruemaya-cherez-bluetooth-le","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Android 14, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0447\u0435\u0440\u0435\u0437 Bluetooth LE | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 GrapheneOS, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0435 \u043e\u0442\u0432\u0435\u0442\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0442 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u044b AOSP (Android Open Source Project), \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Bluetooth-\u0441\u0442\u0435\u043a\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android 14, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-android-14-ekspluatiruemaya-cherez-bluetooth-le","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-12T10:25:57+00:00","article:modified_time":"2024-03-12T10:25:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/114268","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=114268"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/114268\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=114268"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=114268"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=114268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}