{"id":114268,"date":"2024-03-12T12:25:57","date_gmt":"2024-03-12T10:25:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-android-14-ekspluatiruemaya-cherez-bluetooth-le"},"modified":"2024-03-12T12:25:57","modified_gmt":"2024-03-12T10:25:57","slug":"uyazvimost-v-android-14-ekspluatiruemaya-cherez-bluetooth-le","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-android-14-ekspluatiruemaya-cherez-bluetooth-le","title":{"rendered":"Vulnerabilitet n\u00eb Android 14, i shfryt\u00ebzuar p\u00ebrmes Bluetooth LE","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Zhvilluesit e projektit GrapheneOS, q\u00eb po zhvillon nj\u00eb deg\u00eb t\u00eb sigurt nga kodi burimor AOSP (Android Open Source Project), kan\u00eb zbuluar nj\u00eb vulnerabilitet n\u00eb stakun Bluetooth t\u00eb platform\u00ebs Android 14, i cili potencialisht mund t\u00eb \u00e7oj\u00eb n\u00eb ekzekutimin e kodit n\u00eb distanc\u00eb. Problemi shkaktohet nga qasja n\u00eb nj\u00eb zon\u00eb t\u00eb liruar tashm\u00eb t\u00eb memories (use-after-free) n\u00eb kodin p\u00ebr p\u00ebrpunimin e z\u00ebrit t\u00eb transmetuar p\u00ebrmes Bluetooth LE. <\/p>\n

Vulnerabiliteti u zbulua fal\u00eb integrimit n\u00eb thirrjen hardened_malloc t\u00eb nj\u00eb mbrojtjeje shtes\u00eb, e cila p\u00ebrdor zgjerimin ARMv8.5 MTE (MemTag, Memory Tagging Extension), duke mund\u00ebsuar lidhjen e etiketimeve me \u00e7do operacion t\u00eb alokimit t\u00eb memories dhe organizimin e kontrollit t\u00eb sakt\u00ebsis\u00eb s\u00eb p\u00ebrdorimit t\u00eb treguesve p\u00ebr t\u00eb bllokuar shfryt\u00ebzimin e vulnerabiliteteve t\u00eb shkaktuara nga qasja n\u00eb blloqe memorie q\u00eb jan\u00eb liruar tashm\u00eb, mbushjeve t\u00eb tampon\u00ebve, qasjeve para inicializimit dhe p\u00ebrdorimit jasht\u00eb kontekstit aktual. <\/p>\n

Gabimi shfaqet q\u00eb nga p\u00ebrdit\u00ebsimi Android 14 QPR2 (\u00c7lirim Platforme \u00c7erektor), i publikuar n\u00eb fillim t\u00eb marsit. N\u00eb kodin kryesor t\u00eb platform\u00ebs Android 14, mekanizmi MTE \u00ebsht\u00eb n\u00eb dispozicion si nj\u00eb opsion dhe p\u00ebr momentin nuk p\u00ebrdoret si parazgjedhje, megjithat\u00eb n\u00eb GrapheneOS ai \u00ebsht\u00eb aktivizuar p\u00ebr mbrojtje shtes\u00eb, duke lejuar diagnostikimin e gabimit pas p\u00ebrdit\u00ebsimit n\u00eb Android 14 QPR2. Gabimi shkaktonte nj\u00eb mbyllje t\u00eb papritur kur p\u00ebrdor\u00ebshin kufjet Bluetooth Samsung Galaxy Buds2 Pro me firmware, n\u00eb t\u00eb cilin \u00ebsht\u00eb aktivizuar mbrojtja me baz\u00eb MTE. Analiza e incidentit tregoi se problemi \u00ebsht\u00eb i lidhur me qasjen n\u00eb memorie t\u00eb l\u00ebshuar tashm\u00eb n\u00eb trajtuesin Bluetooth LE, dhe jo me nj\u00eb d\u00ebshtim t\u00eb shkaktuar nga integrimi i MTE. <\/p>\n

Vulnerabiliteti \u00ebsht\u00eb rregulluar n\u00eb versionin GrapheneOS 2024030900 dhe prek nd\u00ebrtimet p\u00ebr smartphone q\u00eb nuk kan\u00eb p\u00ebrfshir\u00eb mbrojtjen shtes\u00eb harduerike bazuar n\u00eb zgjerimin MTE (MTE \u00ebsht\u00eb p\u00ebr momentin aktiv vet\u00ebm p\u00ebr pajisjet Pixel 8 dhe Pixel 8 Pro). Vulnerabiliteti p\u00ebrs\u00ebritet n\u00eb smartphone-t Google Pixel 8 me softuerin e bazuar n\u00eb Android 14 QPR2. N\u00eb Android p\u00ebr smartphone-t e seris\u00eb Pixel 8, modelet e MTE mund t\u00eb aktivizohen n\u00eb cil\u00ebsimet p\u00ebr zhvilluesit («Cil\u00ebsimet \/ Sistemi \/ Opsionet e zhvilluesve \/ Zgjerimet e Etiketimit t\u00eb Memories»). Aktivizimi i MTE rrit konsumimin e memories me rreth 3%, por nuk ndikon n\u00eb performanc\u00ebn.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 GrapheneOS, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0435 \u043e\u0442\u0432\u0435\u0442\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0442 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u044b AOSP (Android Open Source Project), \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Bluetooth-\u0441\u0442\u0435\u043a\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android 14, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435\u043c \u043a \u0443\u0436\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0451\u043d\u043d\u043e\u0439 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043f\u0430\u043c\u044f\u0442\u0438 (use-after-free) \u0432 \u043a\u043e\u0434\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0432\u0443\u043a\u0430, \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u0447\u0435\u0440\u0435\u0437 Bluetooth LE. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0432 \u0432\u044b\u0437\u043e\u0432 hardened_malloc \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114268","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabiliteti n\u00eb Android 14, i shfryt\u00ebzuar p\u00ebrmes Bluetooth LE | ProHoster","description":"Zhvilluesit e projektit GrapheneOS, q\u00eb zhvillon nj\u00eb deg\u00eb t\u00eb sigurt nga baza e kodit AOSP (Android Open Source Project), zbuluan nj\u00eb vulnerabilitet n\u00eb stek Bluetooth t\u00eb platform\u00ebs Android 14, i cili potencialisht mund t\u00eb \u00e7oj\u00eb n\u00eb ekzekutimin e kodit nga larg. Problemi shkaktohet nga aksesimi i nj\u00eb zone t\u00eb memories q\u00eb \u00ebsht\u00eb \u00e7liruar tashm\u00eb (use-after-free) n\u00eb kodin e procesit t\u00eb z\u00ebrit t\u00eb transmetuar p\u00ebrmes Bluetooth LE. Vulnerabiliteti u zbuluar p\u00ebrmes integrimit n\u00eb thirrjen hardened_malloc t\u00eb nj\u00eb mbrojtjeje shtes\u00eb.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-android-14-ekspluatiruemaya-cherez-bluetooth-le","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Android 14, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0447\u0435\u0440\u0435\u0437 Bluetooth LE | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 GrapheneOS, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0435 \u043e\u0442\u0432\u0435\u0442\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0442 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u044b AOSP (Android Open Source Project), \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Bluetooth-\u0441\u0442\u0435\u043a\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android 14, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435\u043c \u043a \u0443\u0436\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0451\u043d\u043d\u043e\u0439 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043f\u0430\u043c\u044f\u0442\u0438 (use-after-free) \u0432 \u043a\u043e\u0434\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0432\u0443\u043a\u0430, \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u0447\u0435\u0440\u0435\u0437 Bluetooth LE. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0432 \u0432\u044b\u0437\u043e\u0432 hardened_malloc \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b,","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-android-14-ekspluatiruemaya-cherez-bluetooth-le","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-12T10:25:57+00:00","article:modified_time":"2024-03-12T10:25:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/114268","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=114268"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/114268\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=114268"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=114268"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=114268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}