{"id":114268,"date":"2024-03-12T12:25:57","date_gmt":"2024-03-12T10:25:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-android-14-ekspluatiruemaya-cherez-bluetooth-le"},"modified":"2024-03-12T12:25:57","modified_gmt":"2024-03-12T10:25:57","slug":"uyazvimost-v-android-14-ekspluatiruemaya-cherez-bluetooth-le","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-android-14-ekspluatiruemaya-cherez-bluetooth-le","title":{"rendered":"Nj\u00eb dob\u00ebsi n\u00eb Android 14, e shfryt\u00ebzuar p\u00ebrmes Bluetooth LE","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Zhvilluesit e projektit GrapheneOS, t\u00eb cil\u00ebs i \u00ebsht\u00eb zhvilluar nj\u00eb dega e sigurt nga kodbaz\u00eb AOSP (Android Open Source Project), kan\u00eb zbuluar nj\u00eb dob\u00ebsi n\u00eb paket\u00ebn Bluetooth t\u00eb platform\u00ebs Android 14, e cila mund t\u00eb \u00e7oj\u00eb potencialisht n\u00eb ekzekutimin e kodit n\u00eb distanc\u00eb. Problemi shkaktohet nga qasja n\u00eb nj\u00eb zon\u00eb t\u00eb liruar t\u00eb memories (use-after-free) n\u00eb kodin e p\u00ebrpunimit t\u00eb z\u00ebrit t\u00eb transmetuar p\u00ebrmes Bluetooth LE. <\/p>\n

Dob\u00ebsia u identifikua fal\u00eb integrimit n\u00eb thirrjen hardened_malloc t\u00eb nj\u00eb mbrojtjeje shtes\u00eb, e cila p\u00ebrdor zgjatjen ARMv8.5 MTE (MemTag, Memory Tagging Extension), e cila lejon lidhjen e etiketeve me \u00e7do operacion ndarjeje t\u00eb memories dhe organizon verifikimin e sakt\u00ebsis\u00eb s\u00eb p\u00ebrdorimit t\u00eb treguesve p\u00ebr t\u00eb bllokuar shfryt\u00ebzimin e dob\u00ebsive q\u00eb shkaktohen nga qasja n\u00eb blloqe memories t\u00eb liruar tashm\u00eb, mbushjeve t\u00eb tamponit, qasjes deri n\u00eb inicializim dhe p\u00ebrdorimit jasht\u00eb kontekstit aktual. <\/p>\n

Gabimi shfaqet q\u00eb nga p\u00ebrdit\u00ebsimi Android 14 QPR2 (Quarterly Platform Release), i publikuar n\u00eb fillim t\u00eb marsit. N\u00eb kodbaz\u00ebn kryesore t\u00eb platform\u00ebs Android 14, mekanizmi MTE \u00ebsht\u00eb i disponuesh\u00ebm si nj\u00eb opsion dhe p\u00ebr momentin nuk aplikohet si parazgjedhje, por n\u00eb GrapheneOS \u00ebsht\u00eb p\u00ebrdorur tashm\u00eb p\u00ebr mbrojtje shtes\u00eb, duke e mund\u00ebsuar diagnostikimin e gabimit pas p\u00ebrdit\u00ebsimit n\u00eb Android 14 QPR2. Gabimi shkaktoi nj\u00eb nd\u00ebrprerje gjat\u00eb p\u00ebrdorimit t\u00eb kufjeve Bluetooth Samsung Galaxy Buds2 Pro me firmware, n\u00eb t\u00eb cilin \u00ebsht\u00eb aktivizuar mbrojtja e bazuar n\u00eb MTE. Analiza e incidentit tregoi se problemi ishte i lidhur me qasjen n\u00eb memorien e liruar tashm\u00eb n\u00eb trajtuesin Bluetooth LE, dhe jo me nj\u00eb d\u00ebshtim p\u00ebr shkak t\u00eb integrimit t\u00eb MTE. <\/p>\n

Rreziku \u00ebsht\u00eb eliminuar n\u00eb versionin GrapheneOS 2024030900 dhe preku nd\u00ebrtimet p\u00ebr smartphone-t q\u00eb nuk kan\u00eb aktivizuar mbrojtjen shtes\u00eb harduerike bazuar n\u00eb zgjerimin MTE (MTE aktualisht \u00ebsht\u00eb aktivizuar vet\u00ebm p\u00ebr pajisjet Pixel 8 dhe Pixel 8 Pro). Rreziku riprodhohet n\u00eb smartphone-t Google Pixel 8 me firmware t\u00eb bazuar n\u00eb Android 14 QPR2. N\u00eb Android p\u00ebr smartphone-t e seris\u00eb Pixel 8, moda MTE mund t\u00eb aktivizohet n\u00eb cil\u00ebsimet p\u00ebr zhvilluesit (\u2018Settings \/ System \/ Developer options \/ Memory Tagging Extensions\u2019). Aktivizimi i MTE \u00e7on n\u00eb nj\u00eb rritje t\u00eb konsumit t\u00eb memorjes prej rreth 3%, por nuk e pankon performanc\u00ebn.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 GrapheneOS, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0435 \u043e\u0442\u0432\u0435\u0442\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0442 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u044b AOSP (Android Open Source Project), \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Bluetooth-\u0441\u0442\u0435\u043a\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android 14, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435\u043c \u043a \u0443\u0436\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0451\u043d\u043d\u043e\u0439 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043f\u0430\u043c\u044f\u0442\u0438 (use-after-free) \u0432 \u043a\u043e\u0434\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0432\u0443\u043a\u0430, \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u0447\u0435\u0440\u0435\u0437 Bluetooth LE. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0432 \u0432\u044b\u0437\u043e\u0432 hardened_malloc \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114268","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabiliteti n\u00eb Android 14, i shfryt\u00ebzuar p\u00ebrmes Bluetooth LE | ProHoster","description":"Zhvilluesit e projektit GrapheneOS, t\u00eb cil\u00ebs i \u00ebsht\u00eb zhvilluar nj\u00eb dega e sigurt nga kodbaz\u00eb AOSP (Android Open Source Project), kan\u00eb zbuluar nj\u00eb dob\u00ebsi n\u00eb paket\u00ebn Bluetooth t\u00eb platform\u00ebs Android 14, e cila potencialisht mund t\u00eb \u00e7oj\u00eb.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-android-14-ekspluatiruemaya-cherez-bluetooth-le","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Android 14, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0447\u0435\u0440\u0435\u0437 Bluetooth LE | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 GrapheneOS, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0435 \u043e\u0442\u0432\u0435\u0442\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0442 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u044b AOSP (Android Open Source Project), \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Bluetooth-\u0441\u0442\u0435\u043a\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android 14, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-android-14-ekspluatiruemaya-cherez-bluetooth-le","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-12T10:25:57+00:00","article:modified_time":"2024-03-12T10:25:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/114268","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=114268"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/114268\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=114268"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=114268"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=114268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}