Haddii laga faa'iidaysto, cilladahan waxay u oggolaan karaan weeraryahannada inay helaan macluumaad xasaasi ah oo aan la fasixin ama guud ahaan dhibaatooyi karaan
Cilmi-baarayaal ka socda kooxda Google Project Zero, oo daaha laga rogay dhawaan iyada oo boostada blog ah, ah daahfurka 18 baylahda la ogaaday en modem-ka Samsung Exynos 5G/LTE/GSM.
Sida laga soo xigtay wakiilada Google Project Zero, cilmi-baaris dheeraad ah ka dib, kuwa xirfadlayaasha ah waxay awood u yeelan doonaan inay si degdeg ah u diyaariyaan ka faa'iidaysi shaqo taas oo u oggolaanaysa kontoroolka fogaanta in laga helo heerka moduleka wireless, iyagoo ogaanaya oo keliya lambarka taleefanka dhibbanaha. Weerarka waxaa la qaadi karaa iyada oo aan isticmaaluhu ka warqabin umana baahna wax ficil ah isticmaaluhu, taas oo ka dhigaysa qaar ka mid ah dayacanka la ogaaday.
ka afar baylahda ugu khatarta badan (CVE-2023-24033) Oggolow fulinta code ee heerka chip band saldhig iyada oo la adeegsanayo shabakadaha internetka ee dibadda.
Dabayaaqadii 2022 iyo horraantii 2023, Project Zero waxa uu soo sheegay siddeed iyo tobanka beri nuglaanta ee modem Exynos ee uu soo saaray Samsung Semiconductor. Afarta ugu daran ee siddeed iyo tobnaad dayacan (CVE-2023-24033 iyo saddex dayacan oo kale oo aan weli la qoondeeynin CVE-IDs) ayaa oggolaaday fulinta kood fog ee internetka ilaa saldhigga.
14 ka mid ah baylahda soo hadhay. waxaa lagu xusay in leeyihiin heerka darnaanta hoose, maadaama uu weerarku u baahan yahay marin u helka kaabayaasha shabakadda mobaylka ama gelitaanka gudaha ee aaladaha isticmaalaha. Marka laga reebo nuglaanta CVE-2023-24033, kaas oo la soo jeediyay in lagu hagaajiyo casriyeynta firmware-ka Maarso ee aaladaha Google Pixel, arrimuhu wali lama xallin.
Ilaa hadda, waxa kaliya ee laga og yahay nuglaanshaha CVE-2023-24033 waa in ay sababto hubinta qaabka khaldan ee nooca aqbalka ee lagu gudbiyo farriimaha Xeerka Sharaxaada Kulanka (SDP).
Tijaabada Project Zero waxay xaqiijinaysaa in afartan dayacan ay u ogalaanayaan qofka wax weeraraya inuu meel fog wax ka dhimo taleefoonka heerka baseband iyadoon la dhexgalin isticmaale Cilmi baaris dheeri ah oo xaddidan iyo horumarin, waxaan rumeysannahay in weeraryahannada xirfadda leh ay si dhakhso leh u abuuri karaan ka faa'iidaysi hawleed si ay aamusnaan iyo meel fog uga dhimaan aaladaha ay saameeyeen.
Nuglaanta ayaa ka muuqata aaladaha ku qalabaysan Samsung Exynos chips, sIyada oo ku saleysan macluumaadka laga helayo mareegaha dadweynaha ee ku meeleeya chipsets-ka aaladaha, alaabada ay saameysay waxay u badan tahay inay ku jiraan:
- Aaladaha mobilada ee Samsung, oo ay ku jiraan S22, M33, M13, M12, A71, A53, A33, A21s, A13, A12 iyo A04 series;
- Aaladaha gacanta ee Vivo, oo ay ku jiraan S16, S15, S6, X70, X60 iyo X30;
- Google Pixel 6 iyo Pixel 7 ee aaladaha taxanaha ah; iyo
- baabuur kasta oo isticmaalaya Exynos Auto T5123 chipset.
Ilaa ay warshaduhu hagaajiyaan dayacanka, waa lagugula talinayaa adeegsadayaasha taas oo joojisa taageerada VoLTE (Voice-over-LTE) iyo Wi-Fi wicida waxay ka shaqeeyaan goobaha. Deminta goobahan waxay meesha ka saaraysaa halista ka faa'iidaysiga dayacanka.
Khatarta baylahda awgeed iyo xaqiiqada muuqaalka degdega ah ee ka faa'iidaysiga, Google ayaa go'aansatay in ay ka reebto 4-ta dhibaato ee ugu khatarta badan iyo dib u dhigista shaacinta macluumaadka ku saabsan nooca dhibaatooyinka.
Sida had iyo jeer, waxaan ku dhiirigelinaynaa isticmaalayaasha dhamaadka inay cusboonaysiiyaan qalabkooda sida ugu dhakhsaha badan si loo hubiyo inay wadaan dhismayaashii ugu dambeeyay ee hagaajiya dayacanka amniga ee la shaaciyay iyo kuwa aan la shaacin.
Inta ka hartay dayacanka, faahfaahinta jadwalka siideynta waxaa la socon doona 90 maalmood ka dib ogeysiinta soo saaraha (macluumaad ku saabsan dayacanka CVE-2023-26072, CVE-2023-26073, CVE-2023-26074, CVE-2023-26075 iyo CVE-2023-26076 -9-90 hadda waa laga heli karaa nidaamka dabagalka dhiqlaha iyo XNUMX arrimood ee soo hadhay, XNUMXka maalmood ee sugitaanka weli ma dhammaan).
Nuglaanta la soo sheegay CVE-2023-2607* waxaa sababa qulqulka buuxdhaafka ah marka la dejinayo xulashooyinka qaarkood iyo liisaska NrmmMsgCodec iyo NrSmPcoCodec codecs.
Ugu dambeyntii, hadaad xiisaynayso inaad waxbadan ka ogaato waad hubin kartaa faahfaahinta Xiriirka soo socda.