Qaar ka hor Maalmo baarayaal isbaaro u taalay ayaa la sii daayay warka ah inay aqoonsadeen saddex baylah (CVE-2021-0661, CVE-2021-0662, CVE-2021-0663) In firmware ee MediaTek DSP chips, iyo sidoo kale nuglaanta lakabka habaynta maqalka ee MediaTek Audio HAL (CVE-2021-0673). Haddii ay dhacdo in si guul leh looga faa'iidaysto nuglaanta, weeraryahanku waxa uu abaabuli karaa dhageysiga isticmaaleha codsi aan mudnayn ee aaladda Android.
In 2021, MediaTek waxay ku xisaabtantaa ku dhawaad 37% ee shixnadaha chips gaar ah oo loogu talagalay taleefannada casriga ah iyo SoC-yada (Marka loo eego xogta kale, rubuci labaad ee 2021, qaybta MediaTek ee soosaarayaasha chips-yada DSP ee taleefannada casriga ah waxay ahayd 43%).
Waxyaabaha kale, MediaTek DSP chips Waxaa loo adeegsadaa taleefannada casriga ah ee Xiaomi, Oppo, Realme iyo Vivo. Chips MediaTek, oo ku salaysan Tensilica Xtensa microprocessor, ayaa loo isticmaalaa talefannada casriga ah si ay u fuliyaan hawlgallada sida codka, sawirka iyo habaynta muuqaalka, xisaabinta hababka dhabta ah ee la kordhiyey, aragtida kombuyuutarka iyo barashada mashiinka, iyo sidoo kale si loo hirgeliyo lacag-bixin degdeg ah.
Dib-u-dejinta Firmware-ka injineernimada ee DSP Chips ka MediaTek ku salaysan FreeRTOS madal ayaa shaaca ka qaaday habab kala duwan oo loo socodsiiyo koodka dhinaca firmware-ka oo loo xakameeyo hawlaha DSP adoo diraya codsiyo si gaar ah loo farsameeyay oo ka yimid codsiyada aan mudnaanta lahayn ee aaladda Android.
Tusaalooyinka wax ku oolka ah ee weerarada ayaa lagu soo bandhigay Xiaomi Redmi Note 9 5G oo ku qalabaysan MediaTek MT6853 SoC (Dimensity 800U). Waxaa la xusay in OEM-yadu ay mar hore heleen hagaajinta nuglaanta ee MediaTek's October firmware update.
Hadafka cilmi-baaristayadu waa in la helo hab lagu weeraro Android Audio DSP. Marka hore, waxaan u baahanahay inaan fahanno sida Android uu ugu shaqeynayo processor-ka Application (AP) uu ula xiriiro processor-ka maqalka. Sida iska cad, waa in uu jiraa kontaroole sugaya codsiyada goobta isticmaalaha Android ka dibna isticmaalaya nooc ka mid ah isgaarsiinta interprocessor (IPC) u gudbiya codsiyadan DSP si loo habeeyo.
Waxaan u isticmaalnay Xiaomi Redmi Note 9 5G casriga ah ee ku saleysan MT6853 (Dimensity 800U) chipset sida qalab tijaabo ah. Nidaamku waa MIUI Global 12.5.2.0 (Android 11 RP1A.200720.011).
Maadaama ay jiraan dhowr darawal oo la xiriira warbaahinta oo lagu soo bandhigay aaladda, ma adkeyd in la helo darawalka mas'uulka ka ah isgaarsiinta AP iyo DSP.
Waxaa ka mid ah weerarrada lagu fulin karo iyadoo lagu fulinayo koodka heerka firmware ee chip DSP:
- Helitaanka nidaamka xakamaynta ee dhaafka iyo kordhinta mudnaanta: qabashada aan muuqan ee xogta sida sawirada, fiidyaha, duubista wicitaanka, xogta makarafoonka, GPS, iwm.
- Diidmada adeegga iyo falalka xaasidnimada leh: xannibo gelitaanka macluumaadka, jooji ilaalinta kulaylka inta lagu jiro dallacaadda degdegga ah.
- Qari dhaqdhaqaaqa xaasidnimada - Abuur gebi ahaanba aan la arki karin oo aan la tirtirin qaybaha xaasidnimada ah ee ku shaqeeya heerka firmware.
- Ku dheji summada si aad u basaasto isticmaale, sida ku darista calaamado qarsoon sawir ama muuqaal ka dibna ku xidhidh xogta la dhejiyay isticmaalaha.
Faahfaahinta nuglaanshaha MediaTek Audio HAL weli lama shaacin, laakiin lsida saddex baylahda kale ee DSP firmware waxaa sababa jeeg cidhif oo khaldan marka la farsameynayo fariimaha IPI (Inter-Processor Interrupt) waxaa u soo diray darawalka maqalka audio_ipi ee DSP.
Dhibaatooyinkani waxay suurtogal ka dhigayaan inay keenaan bakhaar la kantaroolay oo ku qulqulaya maamulayaasha ay bixiso firmware-ka, kaas oo macluumaadka ku saabsan xajmiga xogta la gudbiyay laga soo qaatay goob ku dhex jirta xirmada IPI, iyada oo aan la xaqiijinin cabbirka dhabta ah ee loo qoondeeyay xusuusta la wadaago. .
Si loo helo maamulaha inta lagu jiro tijaabooyinka, waxaan isticmaalnaa wicis toos ah ioctls ama maktabadda /vendor/lib/hw/audio.primary.mt6853.so, kuwaas oo aan la heli karin abka Android ee caadiga ah. Si kastaba ha ahaatee, cilmi-baarayaashu waxay heleen xal si ay u soo diraan amarro ku salaysan isticmaalka ikhtiyaarka cilladaha ee ay heli karaan codsiyada dhinac saddexaad.
Halbeegyada la cayimay waxaa lagu beddeli karaa iyadoo la wacayo adeegga Android AudioManager si loo weeraro Maktabadaha MediaTek Aurisys HAL (libfvaudio.so), kuwaas oo bixiya wicitaano lagula falgalo DSP. Si loo joojiyo xalkan, MediaTek waxay meesha ka saartay awooda isticmaalka PARAM_FILE amarka iyada oo loo marayo AudioManager.
Finalmente haddii aad xiisaynayso inaad waxbadan ka ogaato, waad hubin kartaa faahfaahinta Xiriirka soo socda.