Byl zve\u0159ejn\u011bn bal\u00ed\u010dek z\u00e1plat, kter\u00fd odstra\u0148uje 6 zranitelnost\u00ed v bootloaderu GRUB2, z nich\u017e v\u011bt\u0161ina vede k p\u0159\u00edstupu k pam\u011bti po jej\u00edm uvoln\u011bn\u00ed (use-after-free). Potenci\u00e1ln\u011b zji\u0161t\u011bn\u00e9 probl\u00e9my mohou b\u00fdt vyu\u017eity k obch\u00e1zen\u00ed mechanismu ov\u011b\u0159ovan\u00e9ho spou\u0161t\u011bn\u00ed UEFI Secure Boot. Stav odstran\u011bn\u00ed zranitelnost\u00ed v distribuc\u00edch lze posoudit na t\u011bchto str\u00e1nk\u00e1ch: Debian, Ubuntu, SUSE, RHEL, Arch a Fedora. Pro odstran\u011bn\u00ed probl\u00e9m\u016f v GRUB2 nen\u00ed dostate\u010dn\u00e9 pouze aktualizovat bal\u00ed\u010dek, je tak\u00e9 nutn\u00e9 vytvo\u0159it nov\u00e9 vnit\u0159n\u00ed digit\u00e1ln\u00ed podpisy a aktualizovat instal\u00e1tory, bootloadery, bal\u00ed\u010dky j\u00e1dra, fwupd firmware a shim vrstvu. <\/p>\n
Zji\u0161t\u011bn\u00e9 zranitelnosti: <\/p>\n
V\u011bt\u0161ina distribuc\u00ed Linuxu pro verifikovanou bootov\u00e1n\u00ed v re\u017eimu UEFI Secure Boot pou\u017e\u00edv\u00e1 malou vrstvu shim, ov\u011b\u0159enou digit\u00e1ln\u00edm podpisem Microsoftu. Tato vrstva ov\u011b\u0159uje GRUB2 vlastn\u00edm certifik\u00e1tem, co\u017e umo\u017e\u0148uje v\u00fdvoj\u00e1\u0159\u016fm distribuc\u00ed nezaru\u010dovat ka\u017edou aktualizaci j\u00e1dra a GRUB u Microsoftu. Zranitelnosti v GRUB2 umo\u017e\u0148uj\u00ed prov\u00e9st vlastn\u00ed k\u00f3d ve f\u00e1zi po \u00fasp\u011b\u0161n\u00e9 verifikaci shim, ale p\u0159ed na\u010dten\u00edm opera\u010dn\u00edho syst\u00e9mu, vkl\u00edzen\u00edm do \u0159et\u011bzce d\u016fv\u011bry p\u0159i aktivn\u00edm re\u017eimu Secure Boot a z\u00edsk\u00e1n\u00edm pln\u00e9 kontroly nad dal\u0161\u00edm procesem bootov\u00e1n\u00ed, nap\u0159\u00edklad pro na\u010dten\u00ed jin\u00e9ho opera\u010dn\u00edho syst\u00e9mu, modifikaci komponent opera\u010dn\u00edho syst\u00e9mu a obch\u00e1zen\u00ed ochrany Lockdown. <\/p>\n
Pro zablokov\u00e1n\u00ed zranitelnosti bez odvol\u00e1n\u00ed digit\u00e1ln\u00edho podpisu mohou distribuce pou\u017e\u00edt mechanismus SBAT (UEFI Secure Boot Advanced Targeting), jeho\u017e podpora byla implementov\u00e1na pro GRUB2, shim a fwupd ve v\u011bt\u0161in\u011b popul\u00e1rn\u00edch distribuc\u00ed Linuxu. SBAT byl vyvinut ve spolupr\u00e1ci s Microsoftem a zahrnuje p\u0159id\u00e1n\u00ed dal\u0161\u00edch metadat do spustiteln\u00fdch soubor\u016f komponent UEFI, kter\u00e1 obsahuj\u00ed informace o v\u00fdrobci, produktu, komponent\u011b a verzi. Uveden\u00e1 metadata jsou digit\u00e1ln\u011b podeps\u00e1na a mohou b\u00fdt samostatn\u011b za\u0159azena do seznam\u016f povolen\u00fdch nebo zak\u00e1zan\u00fdch komponent pro UEFI Secure Boot. <\/p>\n
SBAT umo\u017e\u0148uje zablokovat pou\u017e\u00edv\u00e1n\u00ed digit\u00e1ln\u00edho podpisu pro jednotliv\u00e9 verze komponent bez nutnosti revokace kl\u00ed\u010d\u016f pro Secure Boot. Blokov\u00e1n\u00ed zranitelnost\u00ed prost\u0159ednictv\u00edm SBAT nevy\u017eaduje pou\u017eit\u00ed seznamu odvolan\u00fdch certifik\u00e1t\u016f UEFI (dbx), a prob\u00edh\u00e1 na \u00farovni v\u00fdm\u011bny intern\u00edho kl\u00ed\u010de pro generov\u00e1n\u00ed podpis\u016f a aktualizaci GRUB2, shim a dal\u0161\u00edch dod\u00e1van\u00fdch distribu\u010dn\u00edch bootovac\u00edch artefakt\u016f. P\u0159ed zaveden\u00edm SBAT bylo aktualizov\u00e1n\u00ed seznamu odvolan\u00fdch certifik\u00e1t\u016f (dbx, UEFI Revocation List) povinn\u00fdm p\u0159edpokladem pro \u00fapln\u00e9 zablokov\u00e1n\u00ed zranitelnosti, proto\u017ee \u00fato\u010dn\u00edk, bez ohledu na pou\u017e\u00edvan\u00fd opera\u010dn\u00ed syst\u00e9m, mohl k kompromitaci UEFI Secure Boot pou\u017e\u00edt bootovac\u00ed m\u00e9dium se starou zranitelnou verz\u00ed GRUB2, ov\u011b\u0159enou digit\u00e1ln\u00edm podpisem. \u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043d\u0430\u0431\u043e\u0440 \u043f\u0430\u0442\u0447\u0435\u0439 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 6 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044e \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u043e\u0441\u043b\u0435 \u0435\u0451 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f (use-after-free). \u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot. \u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u043c\u043e\u0436\u043d\u043e \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u043d\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430\u0445: Debian, Ubuntu, SUSE, RHEL, Arch \u0438 Fedora. \u0414\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-149133","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd476 zranitelnost\u00ed v bootloaderu GRUB2, kter\u00e9 umo\u017e\u0148uj\u00ed obej\u00edt UEFI Secure Boot | ProHoster","description":"Byl zve\u0159ejn\u011bn bal\u00ed\u010dek z\u00e1plat, kter\u00fd odstra\u0148uje 6 zranitelnost\u00ed v bootloaderu GRUB2, z nich\u017e v\u011bt\u0161ina vede k p\u0159\u00edstupu k pam\u011bti po jej\u00edm uvoln\u011bn\u00ed (use-after-free).","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/6-uyazvimostej-v-zagruzchike-grub2-pozvolyayushhih-obojti-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd476 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043e\u0431\u043e\u0439\u0442\u0438 UEFI Secure Boot | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043d\u0430\u0431\u043e\u0440 \u043f\u0430\u0442\u0447\u0435\u0439 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 6 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044e \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u043e\u0441\u043b\u0435 \u0435\u0451 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f (use-after-free).","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/6-uyazvimostej-v-zagruzchike-grub2-pozvolyayushhih-obojti-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-11-21T15:11:55+00:00","article:modified_time":"2025-11-21T15:11:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"149133","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:09:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 16:09:19","updated":"2026-01-23 16:09:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/149133","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=149133"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/149133\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=149133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=149133"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=149133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"