Cercet\u0103torii din echipa Google Project Zero au analizat \u00een detaliu tehnica de creare a unui exploit func\u021bional care permite executarea de cod cu drepturi de kernel Linux prin trimiterea unei mesaje SMS sau RCS cu un ata\u0219ament audio special conceput. Atacul are loc f\u0103r\u0103 a necesita ac\u021biuni din partea utilizatorului, inclusiv f\u0103r\u0103 a necesita vizualizarea sau ascultarea mesajului primit. <\/p>\n
Exploitul implic\u0103 dou\u0103 vulnerabilit\u0103\u021bi: \u00een biblioteca Dolby Unified Decoder (CVE-2025-54957) \u0219i driverul bigwave pentru kernel Linux (CVE-2025-36934). Anterior, pentru exploatarea vulnerabilit\u0103\u021bilor \u00een codec-uri era necesar ca utilizatorul s\u0103 asculte sau s\u0103 vizualizeze con\u021binutul mali\u021bios primit. Dup\u0103 integrarea asisten\u021bilor AI \u00een cele mai recente versiuni ale firmware-ului Android, con\u021binutul multimedia primit este automat decodat dup\u0103 primire, sporind semnificativ suprafa\u021ba atacurilor care nu necesit\u0103 ac\u021biuni din partea utilizatorului (0-click). \u00cen contextul mesajelor audio SMS \u0219i RCS, aplica\u021bia Google Messages folose\u0219te serviciul com.google.android.tts pentru a genera automat o transcriere care se aplic\u0103 mesajelor audio \u00een c\u0103ut\u0103rile textuale, permi\u021b\u00e2nd exploatarea vulnerabilit\u0103\u021bilor din codec-urile audio existente f\u0103r\u0103 implicarea utilizatorului. <\/p>\n
Problema din Dolby Unified Decoder este cauzat\u0103 de o dep\u0103\u0219ire a capacit\u0103\u021bii integer \u00een calculul dimensiunii tampon pentru structurile de date syncframe procesate, ceea ce poate fi folosit pentru a scrie \u00een afara tamponului alocat. Ca rezultat al dep\u0103\u0219irii, poate fi suprascris un pointer folosit \u00een procesarea urm\u0103torului cadru de sincronizare, modificarea c\u0103ruia permite, la r\u00e2ndul s\u0103u, suprascrierea pointerului func\u021biei cu date controlate de atacator \u0219i organizarea execu\u021biei codului s\u0103u cu privilegii \u201emediacodec\u201d, restric\u021bionate prin SELinux. <\/p>\n
Pentru exploatarea nucleului Linux a fost folosit\u0103 o vulnerabilitate \u00een driverul bigwave, responsabil cu interac\u021biunea cu dispozitivul simbolic \/dev\/bigwave, la care s-a deschis accesul din contextul SELinux \u201emediacodec\u201d. Vulnerabilitatea permitea suprascrierea structurilor nucleului prin manipul\u0103ri cu apelul ioctl BIGO_IOCX_PROCESS \u0219i ob\u021binerea execu\u021biei codului cu privilegii de nucleu. <\/p>\n
O vulnerabilitate \u00een biblioteca Dolby Unified Decoder (libcodec2_soft_ddpdec.so), care ofer\u0103 func\u021bii pentru decodarea formatelor Dolby Digital (DD, AC-3) \u0219i Dolby Digital Plus (DD+, EAC-3), nu este specific\u0103 pentru Android \u0219i firmware-ul Pixel 9, ci apare \u0219i pe alte platforme (Samsung S24, MacBook Air M1, iPhone 17 Pro, Windows, ChromeOS etc.). \u00cen repositoriul Android AOSP \u0219i firmware-ul pentru Samsung S24, procesele care ruleaz\u0103 \u00een contextul mediacodec aplic\u0103 un filtru seccomp pentru apelurile de sistem, \u00eengreun\u00e2nd exploatarea ulterioar\u0103 a vulnerabilit\u0103\u021bilor \u00een nucleu. \u00cen firmware-ul pentru Pixel 9, un astfel de filtru lipsea. De atacuri ar putea s\u0103 protejeze<\/a> Mecanismul Memory Tagging (MTE), \u00eens\u0103, este disponibil pentru dispozitivele Pixel 8+ doar sub form\u0103 de op\u021biune activat\u0103 la activarea modului \u201eAdvanced Protection\u201d. \u00cen macOS \u0219i iOS, exploatarea este complicat\u0103 de compilarea bibliotecii cu flag-ul \u201e-fbounds-safety\u201d, care adaug\u0103 verific\u0103ri suplimentare pentru a preveni dep\u0103\u0219irea limitelor tablourilor, ce reduc performan\u021ba. <\/p>\n Cercet\u0103torii analizeaz\u0103 \u00een mod separat problemele de disponibilitate a corec\u021biei vulnerabilit\u0103\u021bii \u00een Dolby Unified Decoder pentru utilizatori. Informa\u021biile despre vulnerabilitate au fost f\u0103cute publice cu 82 de zile \u00eenainte de disponibilizarea corec\u021biei pentru utilizatorii dispozitivelor Pixel. Compania Dolby a fost informat\u0103 despre problem\u0103 pe 26 iunie 2025. Prima corec\u021bie binar\u0103 a fost lansat\u0103 pe 18 septembrie pentru ChromeOS, dar pentru dispozitivele Android, compania Dolby a furnizat patch-uri binare abia pe 8 octombrie. Informa\u021biile despre vulnerabilitate au fost dezv\u0103luite public pe 15 octombrie. Pe 12 noiembrie, Samsung a lansat corec\u021bia \u0219i abia pe 5 ianuarie a fost publicat\u0103 corec\u021bia pentru dispozitivele Pixel. Distribu\u021bia patch-ului pentru toate dispozitivele Android a necesitat 139 de zile. <\/p>\n \u00cen Dolby Unified Decoder, vulnerabilitatea a fost identificat\u0103 \u00een mai pu\u021bin de dou\u0103 zile, iar \u00een driverul BigWave \u00een mai pu\u021bin de o zi de revizuire. Efortul necesar pentru dezvoltarea unui exploit func\u021bional pentru vulnerabilitatea din Dolby Unified Decoder este estimat la 8 s\u0103pt\u0103m\u00e2ni de munc\u0103 pentru un singur cercet\u0103tor, iar pentru BigWave la 3 s\u0103pt\u0103m\u00e2ni. \u00cen raportul publicat pe 14 octombrie, compania Dolby a marcat vulnerabilitatea din Dolby Unified Decoder ca av\u00e2nd un nivel sc\u0103zut de pericol, \u00een ciuda transmiterii detalii despre un exploit \u00een curs de dezvoltare. Vulnerabilit\u0103\u021bile din BigWave au primit \u00een Android un nivel mediu de pericol (Moderate), motiv\u00e2nd acest lucru prin faptul c\u0103 atacul este posibil doar din con\u021binut privilegiat \u0219i este inaccesibil \u00een contexte neprivilegiate (dup\u0103 trei luni, statusul vulnerabilit\u0103\u021bii a fost schimbat \u00een \u201eproblem\u0103 periculoas\u0103\u201d). \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b\u0438 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u044f\u0434\u0440\u0430 Linux, \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 SMS- \u0438\u043b\u0438 RCS-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0432\u0443\u043a\u043e\u0432\u044b\u043c \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \u0410\u0442\u0430\u043a\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0431\u0435\u0437 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430 \u0438\u043b\u0438 \u043f\u0440\u043e\u0441\u043b\u0443\u0448\u0438\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f. \u0412 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0435 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-153878","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een firmware-ul Android, care permite executarea de cod prin trimiterea unui mesaj | ProHoster","description":"Cercet\u0103torii din echipa Google Project Zero au analizat \u00een detaliu tehnica pentru crearea unui exploit func\u021bional care s\u0103 permit\u0103 executarea de cod de la distan\u021b\u0103 cu drepturi de acces ale nucleului Linux, prin trimiterea unui mesaj SMS sau RCS special conceput.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-android-proshivke-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-soobshheniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Android-\u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Google Project Zero \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b\u0438 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u044f\u0434\u0440\u0430 Linux, \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 SMS- \u0438\u043b\u0438 RCS-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-android-proshivke-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-soobshheniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-01-17T09:12:33+00:00","article:modified_time":"2026-01-17T09:12:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"153878","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 15:57:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-20 14:13:19","updated":"2026-01-24 15:57:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/153878","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=153878"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/153878\/revisions"}],"predecessor-version":[{"id":154931,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/153878\/revisions\/154931"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=153878"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=153878"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=153878"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"