V ovlada\u010di, kter\u00fd zaji\u0161\u0165uje pr\u00e1ci se souborov\u00fdm syst\u00e9mem NTFS v bootloaderu GRUB2, byla zji\u0161t\u011bna zranitelnost (CVE-2023-4692), kter\u00e1 umo\u017e\u0148uje prov\u00e1d\u011bt vlastn\u00ed k\u00f3d na \u00farovni bootloaderu p\u0159i p\u0159\u00edstupu k speci\u00e1ln\u011b upraven\u00e9mu obrazu souborov\u00e9ho syst\u00e9mu. Tato zranitelnost m\u016f\u017ee b\u00fdt vyu\u017eita k obch\u00e1zen\u00ed mechanismu ov\u011b\u0159en\u00e9ho bootov\u00e1n\u00ed UEFI Secure Boot. <\/p>\n
Zranitelnost je zp\u016fsobena chybou v k\u00f3du pro anal\u00fdzu NTFS atributu «$ATTRIBUTE_LIST» (grub-core\/fs\/ntfs.c), kterou lze vyu\u017e\u00edt k z\u00e1pisu informac\u00ed kontrolovan\u00fdch u\u017eivateli do oblasti pam\u011bti mimo vyhrazen\u00fd buffer. P\u0159i zpracov\u00e1n\u00ed speci\u00e1ln\u011b vytvo\u0159en\u00e9ho obrazu NTFS p\u0159et\u00e9kan\u00ed pam\u011bti vede k p\u0159eps\u00e1n\u00ed \u010d\u00e1sti pam\u011bti GRUB a za ur\u010dit\u00fdch podm\u00ednek k po\u0161kozen\u00ed oblasti pam\u011bti firmwaru UEFI, co\u017e potenci\u00e1ln\u011b umo\u017e\u0148uje spu\u0161t\u011bn\u00ed vlastn\u00edho k\u00f3du na \u00farovni zav\u00e1d\u011b\u010de nebo firmwaru. <\/p>\n
Krom\u011b toho byla v NTFS ovlada\u010di z GRUB2 tak\u00e9 zji\u0161t\u011bna dal\u0161\u00ed zranitelnost (CVE-2023-4693), kter\u00e1 umo\u017e\u0148uje \u010d\u00edst obsah libovoln\u00e9 oblasti pam\u011bti p\u0159i anal\u00fdze atributu «$DATA» v speci\u00e1ln\u011b vytvo\u0159en\u00e9m obrazu NTFS. Mezi jin\u00fdm, zranitelnost umo\u017e\u0148uje extrakci d\u016fv\u011brn\u00fdch \u00fadaj\u016f vyrovnan\u00fdch v pam\u011bti nebo ur\u010den\u00ed hodnot prom\u011bnn\u00fdch EFI. <\/p>\n
Probl\u00e9my byly zat\u00edm vy\u0159e\u0161eny pouze formou patche. Stav odstran\u011bn\u00ed zranitelnost\u00ed v distribuc\u00edch lze posoudit na t\u011bchto str\u00e1nk\u00e1ch: Debian, Ubuntu, SUSE, RHEL, Fedora. Pro odstran\u011bn\u00ed probl\u00e9m\u016f v GRUB2 nesta\u010d\u00ed pouze aktualizovat bal\u00edk, je tak\u00e9 nutn\u00e9 vytvo\u0159it nov\u00e9 vnit\u0159n\u00ed digit\u00e1ln\u00ed podpisy a aktualizovat instal\u00e1tory, bootloadery, bal\u00edky j\u00e1dra, fwupd firmware a shim vrstvu. <\/p>\n
V\u011bt\u0161ina distribuc\u00ed Linuxu pro verifikovanou bootov\u00e1n\u00ed v re\u017eimu UEFI Secure Boot pou\u017e\u00edv\u00e1 malou vrstvu shim, ov\u011b\u0159enou digit\u00e1ln\u00edm podpisem Microsoftu. Tato vrstva ov\u011b\u0159uje GRUB2 vlastn\u00edm certifik\u00e1tem, co\u017e umo\u017e\u0148uje v\u00fdvoj\u00e1\u0159\u016fm distribuc\u00ed nezaru\u010dovat ka\u017edou aktualizaci j\u00e1dra a GRUB u Microsoftu. Zranitelnosti v GRUB2 umo\u017e\u0148uj\u00ed prov\u00e9st vlastn\u00ed k\u00f3d ve f\u00e1zi po \u00fasp\u011b\u0161n\u00e9 verifikaci shim, ale p\u0159ed na\u010dten\u00edm opera\u010dn\u00edho syst\u00e9mu, vkl\u00edzen\u00edm do \u0159et\u011bzce d\u016fv\u011bry p\u0159i aktivn\u00edm re\u017eimu Secure Boot a z\u00edsk\u00e1n\u00edm pln\u00e9 kontroly nad dal\u0161\u00edm procesem bootov\u00e1n\u00ed, nap\u0159\u00edklad pro na\u010dten\u00ed jin\u00e9ho opera\u010dn\u00edho syst\u00e9mu, modifikaci komponent opera\u010dn\u00edho syst\u00e9mu a obch\u00e1zen\u00ed ochrany Lockdown. <\/p>\n
Pro zablokov\u00e1n\u00ed zranitelnosti bez odvol\u00e1n\u00ed digit\u00e1ln\u00edho podpisu mohou distribuce pou\u017e\u00edt mechanismus SBAT (UEFI Secure Boot Advanced Targeting), jeho\u017e podpora byla implementov\u00e1na pro GRUB2, shim a fwupd ve v\u011bt\u0161in\u011b popul\u00e1rn\u00edch distribuc\u00ed Linuxu. SBAT byl vyvinut ve spolupr\u00e1ci s Microsoftem a zahrnuje p\u0159id\u00e1n\u00ed dal\u0161\u00edch metadat do spustiteln\u00fdch soubor\u016f komponent UEFI, kter\u00e1 obsahuj\u00ed informace o v\u00fdrobci, produktu, komponent\u011b a verzi. Uveden\u00e1 metadata jsou digit\u00e1ln\u011b podeps\u00e1na a mohou b\u00fdt samostatn\u011b za\u0159azena do seznam\u016f povolen\u00fdch nebo zak\u00e1zan\u00fdch komponent pro UEFI Secure Boot. <\/p>\n
SBAT umo\u017e\u0148uje blokovat pou\u017e\u00edv\u00e1n\u00ed digit\u00e1ln\u00edho podpisu pro jednotliv\u00e9 verze komponent\u016f bez nutnosti odvol\u00e1v\u00e1n\u00ed kl\u00ed\u010d\u016f pro Secure Boot. Blokov\u00e1n\u00ed zranitelnost\u00ed prost\u0159ednictv\u00edm SBAT nevy\u017eaduje pou\u017eit\u00ed seznamu zru\u0161en\u00fdch certifik\u00e1t\u016f UEFI (dbx) a prov\u00e1d\u00ed se na \u00farovni nahrazen\u00ed intern\u00edho kl\u00ed\u010de pro vytv\u00e1\u0159en\u00ed podpis\u016f a aktualizaci GRUB2, shim a dal\u0161\u00edch dod\u00e1van\u00fdch distribuc\u00ed bootovac\u00edch artefakt\u016f. P\u0159ed zaveden\u00edm SBAT bylo aktualizov\u00e1n\u00ed seznamu zru\u0161en\u00fdch certifik\u00e1t\u016f (dbx, UEFI Revocation List) nezbytnou podm\u00ednkou pro \u00fapln\u00e9 blokov\u00e1n\u00ed zranitelnosti, proto\u017ee \u00fato\u010dn\u00edk, bez ohledu na pou\u017e\u00edvan\u00fd opera\u010dn\u00ed syst\u00e9m, mohl pro kompromitaci UEFI Secure Boot pou\u017e\u00edt bootovac\u00ed \u0412 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 NTFS \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-4692), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u043e\u0431\u0440\u0430\u0437\u0443 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043a\u043e\u0434\u0435 \u0440\u0430\u0437\u0431\u043e\u0440\u0430 NTFS-\u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0430 «$ATTRIBUTE_LIST» (grub-core\/fs\/ntfs.c), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110421","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v NTFS ovlada\u010di sou\u010d\u00e1sti GRUB2, kter\u00e1 umo\u017e\u0148uje vykonat k\u00f3d a obej\u00edt UEFI Secure Boot | ProHoster","description":"V ovlada\u010di zaji\u0161\u0165uj\u00edc\u00edm pr\u00e1ci s \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 NTFS ve spou\u0161t\u011b\u010di GRUB2 byla zji\u0161t\u011bna zranitelnost (CVE-2023-4692), kter\u00e1 umo\u017e\u0148uje prov\u00e1d\u011bt vlastn\u00ed k\u00f3d na \u00farovni spou\u0161t\u011b\u010de p\u0159i p\u0159\u00edstupu k speci\u00e1ln\u011b.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 NTFS-\u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435 \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 GRUB2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 UEFI Secure Boot | ProHoster","og:description":"\u0412 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 NTFS \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-4692), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-04T07:10:18+00:00","article:modified_time":"2023-10-04T07:10:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/110421","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=110421"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/110421\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=110421"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=110421"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=110421"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"