Byly zve\u0159ejn\u011bny informace o 21 zranitelnostech ve zavad\u011b\u010di GRUB2, z nich\u017e v\u011bt\u0161ina vede k p\u0159ete\u010den\u00ed buffera a m\u016f\u017ee b\u00fdt vyu\u017eita k obch\u00e1zen\u00ed mechanismu ov\u011b\u0159en\u00e9ho spu\u0161t\u011bn\u00ed UEFI Secure Boot. Probl\u00e9my byly prozat\u00edm odstran\u011bny pouze ve form\u011b patch\u016f. Stav odstran\u011bn\u00ed zranitelnost\u00ed v distribuc\u00edch lze posoudit na n\u00e1sleduj\u00edc\u00edch str\u00e1nk\u00e1ch: Debian, Ubuntu, SUSE, RHEL, Fedora. K odstran\u011bn\u00ed probl\u00e9m\u016f v GRUB2 nesta\u010d\u00ed pouze aktualizovat bal\u00ed\u010dek, je tak\u00e9 pot\u0159eba vytvo\u0159it nov\u00e9 vnit\u0159n\u00ed digit\u00e1ln\u00ed podpisy a aktualizovat instal\u00e1tory, zavad\u011b\u010de, bal\u00ed\u010dky j\u00e1dra, fwupd firmwary a shim vrstvu. <\/p>\n
Zji\u0161t\u011bn\u00e9 zranitelnosti: <\/p>\n
V\u011bt\u0161ina distribuc\u00ed Linuxu pro verifikovanou bootov\u00e1n\u00ed v re\u017eimu UEFI Secure Boot pou\u017e\u00edv\u00e1 malou vrstvu shim, ov\u011b\u0159enou digit\u00e1ln\u00edm podpisem Microsoftu. Tato vrstva ov\u011b\u0159uje GRUB2 vlastn\u00edm certifik\u00e1tem, co\u017e umo\u017e\u0148uje v\u00fdvoj\u00e1\u0159\u016fm distribuc\u00ed nezaru\u010dovat ka\u017edou aktualizaci j\u00e1dra a GRUB u Microsoftu. Zranitelnosti v GRUB2 umo\u017e\u0148uj\u00ed prov\u00e9st vlastn\u00ed k\u00f3d ve f\u00e1zi po \u00fasp\u011b\u0161n\u00e9 verifikaci shim, ale p\u0159ed na\u010dten\u00edm opera\u010dn\u00edho syst\u00e9mu, vkl\u00edzen\u00edm do \u0159et\u011bzce d\u016fv\u011bry p\u0159i aktivn\u00edm re\u017eimu Secure Boot a z\u00edsk\u00e1n\u00edm pln\u00e9 kontroly nad dal\u0161\u00edm procesem bootov\u00e1n\u00ed, nap\u0159\u00edklad pro na\u010dten\u00ed jin\u00e9ho opera\u010dn\u00edho syst\u00e9mu, modifikaci komponent opera\u010dn\u00edho syst\u00e9mu a obch\u00e1zen\u00ed ochrany Lockdown. <\/p>\n
Pro zablokov\u00e1n\u00ed zranitelnosti bez odvol\u00e1n\u00ed digit\u00e1ln\u00edho podpisu mohou distribuce pou\u017e\u00edt mechanismus SBAT (UEFI Secure Boot Advanced Targeting), jeho\u017e podpora byla implementov\u00e1na pro GRUB2, shim a fwupd ve v\u011bt\u0161in\u011b popul\u00e1rn\u00edch distribuc\u00ed Linuxu. SBAT byl vyvinut ve spolupr\u00e1ci s Microsoftem a zahrnuje p\u0159id\u00e1n\u00ed dal\u0161\u00edch metadat do spustiteln\u00fdch soubor\u016f komponent UEFI, kter\u00e1 obsahuj\u00ed informace o v\u00fdrobci, produktu, komponent\u011b a verzi. Uveden\u00e1 metadata jsou digit\u00e1ln\u011b podeps\u00e1na a mohou b\u00fdt samostatn\u011b za\u0159azena do seznam\u016f povolen\u00fdch nebo zak\u00e1zan\u00fdch komponent pro UEFI Secure Boot. <\/p>\n
SBAT umo\u017e\u0148uje zablokovat pou\u017e\u00edv\u00e1n\u00ed digit\u00e1ln\u00edho podpisu pro jednotliv\u00e9 verze komponent bez nutnosti revokace kl\u00ed\u010d\u016f pro Secure Boot. Blokov\u00e1n\u00ed zranitelnost\u00ed prost\u0159ednictv\u00edm SBAT nevy\u017eaduje pou\u017eit\u00ed seznamu odvolan\u00fdch certifik\u00e1t\u016f UEFI (dbx), a prob\u00edh\u00e1 na \u00farovni v\u00fdm\u011bny intern\u00edho kl\u00ed\u010de pro generov\u00e1n\u00ed podpis\u016f a aktualizaci GRUB2, shim a dal\u0161\u00edch dod\u00e1van\u00fdch distribu\u010dn\u00edch bootovac\u00edch artefakt\u016f. P\u0159ed zaveden\u00edm SBAT bylo aktualizov\u00e1n\u00ed seznamu odvolan\u00fdch certifik\u00e1t\u016f (dbx, UEFI Revocation List) povinn\u00fdm p\u0159edpokladem pro \u00fapln\u00e9 zablokov\u00e1n\u00ed zranitelnosti, proto\u017ee \u00fato\u010dn\u00edk, bez ohledu na pou\u017e\u00edvan\u00fd opera\u010dn\u00ed syst\u00e9m, mohl k kompromitaci UEFI Secure Boot pou\u017e\u00edt bootovac\u00ed m\u00e9dium se starou zranitelnou verz\u00ed GRUB2, ov\u011b\u0159enou digit\u00e1ln\u00edm podpisem. \u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e 21 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u043e\u043a\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u0438\u0434\u0435 \u043f\u0430\u0442\u0447\u0430. \u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u043c\u043e\u0436\u043d\u043e \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u043d\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430\u0445: Debian, Ubuntu, SUSE, RHEL, Fedora. \u0414\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0432 GRUB2 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-122049","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 V bootloaderu GRUB2 bylo identifikov\u00e1no 21 zranitelnost\u00ed | ProHoster","description":"Byly zve\u0159ejn\u011bny informace o 21 zranitelnostech v bootloaderu GRUB2, z nich\u017e v\u011bt\u0161ina vede k p\u0159ete\u010den\u00ed bufferu a m\u016f\u017ee b\u00fdt pou\u017eita k obch\u00e1zen\u00ed mechanismu ov\u011b\u0159en\u00e9ho spu\u0161t\u011bn\u00ed UEFI Secure Boot.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-zagruzchike-grub2-vyyavlena-21-uyazvimost","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 21 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e 21 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-zagruzchike-grub2-vyyavlena-21-uyazvimost","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-22T00:22:05+00:00","article:modified_time":"2025-02-22T00:22:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"122049","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 10:50:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:50:19","updated":"2026-01-23 10:50:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/122049","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=122049"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/122049\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=122049"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=122049"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=122049"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"