Check Point yakavhurwa munguva pfupi yapfuura kuburikidza neye blog positi yakaratidza kusagadzikana mukati decoders MediaTek (CVE-2021-0674, CVE-2021-0675) uye Qualcomm (CVE-2021-30351) yeApple Lossless Audio Codec (ALAC) odhiyo yekumanikidza fomati.
Zvinonzi dambudziko inobvumira anorwisa kodhi kuti aite uchigadzira yakanyatso kurongeka data mune iyo ALAC fomati. Ngozi yekusagadzikana inowedzerwa nenyaya yekuti inokanganisa zvishandiso zvinomhanyisa Android chikuva, chine MediaTek uye Qualcomm chips.
Nekuda kwekurwisa, munhu anorwisa anogona kuronga kuurayiwa kwemalware pamudziyo iyo inokwanisa kuwana midhiya yevashandisi uye data yekutaurirana, kusanganisira data yekamera.
Maererano nefungidziro yakaoma, 2/3 yevashandisi vese vefoni platform-based smart Android inobatwa nedambudziko. Semuyenzaniso, muUS, chikamu chese cheese mafoni eAndroid akatengeswa muQ2021 95,1 akatumirwa neMediaTek uye Qualcomm machipisi aive 48,1% (47%: MediaTek, XNUMX%: Qualcomm).
Iyo ALAC nyaya dzakawanikwa nevatsvagurudzi dzinogona kushandiswa neanorwisa kure kure kodhi kuuraya (RCE) kurwisa panharembozha kuburikidza nefaira redhiyo risina kurongeka. Kurwiswa kweRCE kunobvumira munhu anorwisa kuti aite kodhi yakaipa ari kure pakombuta. Iko kukanganisa kweRCE kusagadzikana kunogona kubva pakuuraya malware kusvika kune anorwisa achiwana kutonga kwemushandisi wenhau data, kusanganisira kutenderera kubva kune yakakanganiswa kamera yemuchina.
Pamusoro pezvo, isina kurongeka Android application inogona kushandisa kusazvibata uku kukwidziridza ropafadzo dzayo uye kuwana mukana wekukurukurirana kwevashandisi uye data yenhau.
ari Kusagadzikana kweRCE kunobvumira munhu anorwisa kuti aite zvekupokana pamudziyo uri kure. Anorwisa anogona kuwana RCE munzira dzinoverengeka dzakasiyana, kusanganisira:
- Jekiseni kurwisa: akawanda akasiyana marudzi ekushandisa, akadai seSQL mibvunzo, shandisa data-inopihwa nemushandisi sekuisa kune murairo. Mukurwiswa kwejekiseni, anorwisa anopa nemaune kupinza izvo zvinoita kuti chikamu chezvavanoisa chidudzirwe sechikamu chemurairo. Izvi zvinobvumira munhu anorwisa kuumba mirairo inotevedzwa pane isina njodzi system kana kuita zvehumwe kodhi pairi.
- Deserialization kurwisa: Seriization inowanzo shandiswa nemaapplication kusanganisa akawanda zvidimbu zvedata kuita tambo imwe chete kuti zvive nyore kufambisa kana kutaurirana. Yakanyanya kurongeka mushandisi kupinza mukati meiyo serialized data inogona kududzirwa neiyo deserialization chirongwa sekodhi inogoneka.
- Kunyora kunze kwemiganhu: Zvishandiso zvinogara zvichigovera zvakagadziriswa-saizi chunks yendangariro kuchengetedza data, kusanganisira data rinopihwa nemushandisi. Kana uku kugoverwa kwendangariro kukaitwa zvisizvo, anorwisa anogona kugadzira mapindiro anonyora kunze kwebhafa yakapihwa.
Zvakawanda zvekushandiswa kwekusagadzikana hazvisati zvaburitswa, asi zvinoshumwa kuti zvigadziriso zvakaitwa kuMediaTek neQualcomm zvikamu zveAroid platform muna December 2021. Mushumo waDecember pamusoro pekusagadzikana muIndaneti yeAroid, nyaya dzacho dzakaratidzwa sehudziviriro hwakakosha muzvikamu zvakavharwa zveQualcomm chips. Kusagadzikana muMediaTek zvikamu hazvina kutaurwa mumishumo.
Check Point Tsvagiridzo yakaburitsa ruzivo kuMediaTek neQualcomm uye yakashanda pamwe nevatengesi vese kuti ive nechokwadi chekuti kusagadzikana uku kwakagadziriswa.
Kusagadzikana kunonakidza nekuda kwemidzi yako. Muna 2011, Apple yakaburitsa masource codec eALAC codec pasi peApache 2.0 rezinesi, iyo inobvumira kudzvanywa kwedhata redhiyo pasina kurasikirwa kwemhando, uye yakaita kuti zvikwanise kushandisa ese patent ane chekuita necodec. Iyo kodhi yakabudiswa, asi haina kuchengetedzwa uye haina kuchinja mumakore gumi nerimwe apfuura.
Panguva imwecheteyo, Apple yakaramba ichitsigira zvakasiyana kushandiswa kunoshandiswa pamapuratifomu ayo, kusanganisira kugadzirisa tsikidzi uye kusasimba mairi. MediaTek neQualcomm yakavakirwa yavo ALAC codec kuita paApple yekutanga yakavhurika sosi kodhi, asi haina kugadzirisa kusagadzikana kwakagadziriswa nekuitwa kweApple mukuita kwavo.
Iko hakuna ruzivo parizvino nezve kuratidzwa kwekusagadzikana mune kodhi yezvimwe zvigadzirwa zvinoshandisa zvekare ALAC kodhi. Semuenzaniso, iyo ALAC fomati inotsigirwa kubva FFmpeg 1.1, asi iyo decoder yekumisikidza kodhi inochengetedzwa.
Finalmente kana iwe uchifarira kuziva zvakawanda nezvazvo, unogona kutarisa ruzivo Mune inotevera chinongedzo.