هشدار: دستگاه‌های سامسونگ در معرض حمله قرار گرفته‌اند! آشکارشدن یک نقص امنیتی جدید

?? ????? ??????? ?????? ???? ???? ????? ????? ????? ?????? ? ????? ??????? ?????? ????? (CISA) ???? ?? ??????????? ???? ?? ?? ??? ?? ??? ????? ?? ?????????? ??????? ?? ????????? ???? ??????? ????? ???.

??? ???? ?? ?? ??? CVE-2023-21492 (?????? ?/? ?? ????? CVSS) ?????? ??????? ?? ?????????? ??????? ????? ???????? ??? ?? ? ?? ??????? ????? ????????.

??? ??? ????????? ??? ????? ??? ???? ?? ?? ??? ????? ??????? ????? ??? ?? ???????? ???? ?? ????? ????? ???? ?????? ????????? ?????? ???????? ???? ???? ([?]ASLR) ???? ??????????? ???? ????.

ASLR ?? ????? ??????[?] ??? ?? ???? ????????? ????? ????? ? ??? ????? ?? ?? ?????????? ???? ?? ???? ?????? ?? ????? ?????? ????? ??? ???.

??????? ?? ??????[?] ?? ?? ??? ???? ????? ??? ???: «?? ?? ????? ???? ??? ??? ?? ?? ??????????? ???? ??? ???? ?? ??? ??????? ???? ????? ???» ? ????? ??? ?? ?? ?? ?????? ???? ?? ??? ????? ???? ??? ???? ??? ??? ???.

?????? ???? ?? ???? ???? ??????? ?? ??? ??? ?? ??? ???? ???? ????? ??? ????????????? ?? ???????? ??????? ?? ????? ???? ????????? ???????????? ??????[?] ?????[?] ???? ??????? ???????????? ???? ??????????? ???? ?????????.

?? ????? ????? Google Project Zero ?????? ?? ???? MMS ???? ???? ?? ??? ??? ?? ???? ???[?] ?? ?? ?? ??? ???????? ???? ?? ???????? Quram qmg (SVE-2020-16747 ? SVE-2020-17675) ???? ????????? ASLR ? ??????? ?? ????? ?? ??????? ?????.

?? ???? ?? ??? ??????? ????? CISA ??? ??? ?? ?? ???? ?? ??? ????? IOS (CVE-2004-1464 ? CVE-2016-6415) ?? ??????? ???? ????? ??? ???? ??????????? ?????? ??? (KEV) ??? ????? ???? ???[?] ? ?? ????? ??? ????? (FCEB) ?????? ??? ?? ???? ?? ?? ?? ? ???? ???? ????? ????.

???? ?????? CISA ?????? ??? ??????????[?] ?? ?? ??????? KEV ????? ??? ?? ?????????? ???? ?? ??? ?????? ??? ?? ?????? ?? ????????? ???? ?????? (CVE-2010-3904) ?? ?? ?? ????? ???? ??????? ????? ??????[?] ???????? ??? ?? ???? ??? ???? ?????? ???.

?????

[?] https://blog.morphisec.com/aslr-what-it-is-and-what-it-isnt/

[?] https://www.mandiant.com/resources/blog/six-facts-about-address-space-layout-randomization-on-windows

[?] https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=05

[?] https://thehackernews.com/2023/03/spyware-vendors-caught-exploiting-zero.html

[?] https://thehackernews.com/2022/06/google-says-isps-helped-attackers.html

[?] https://googleprojectzero.blogspot.com/2020/08/mms-exploit-part-5-defeating-aslr-getting-rce.html

[?] https://www.cisa.gov/news-events/alerts/2023/05/19/cisa-adds-three-known-exploited-vulnerabilities-catalog

[?] https://www.cisa.gov/news-events/alerts/2023/05/12/cisa-adds-seven-known-exploited-vulnerabilities-catalog

[?] https://www.kb.cert.org/vuls/id/362983

[??] https://thehackernews.com/2023/05/samsung-devices-under-active.html