{"id":110421,"date":"2023-10-04T09:10:18","date_gmt":"2023-10-04T07:10:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot"},"modified":"2023-10-04T09:10:18","modified_gmt":"2023-10-04T07:10:18","slug":"uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","title":{"rendered":"A vulnerability in the NTFS driver of GRUB2 that allows code execution and bypassing UEFI Secure Boot.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I driver, der muligg\u00f8r arbejdet med NTFS-filsystemet i GRUB2-bootloaderen, har en s\u00e5rbarhed (CVE-2023-4692), der g\u00f8r det muligt at udf\u00f8re vilk\u00e5rlig kode p\u00e5 bootloaderniveau ved at tilg\u00e5 et specielt tilpasset filsystembillede. S\u00e5rbarheden kan bruges til at omg\u00e5 mekanismen for verificeret opstart UEFI Secure Boot. <\/p>\n

S\u00e5rbarheden skyldes en fejl i analysen af NTFS-attribute «$ATTRIBUTE_LIST» (grub-core\/fs\/ntfs.c), som kan udnyttes til at skrive brugerdefineret information til hukommelsesomr\u00e5der uden for den tildelte buffer. Ved behandling af et specifikt format NTFS-billede f\u00f8rer bufferoverflow til overskrivning af dele af GRUBs hukommelse, og under s\u00e6rlige omst\u00e6ndigheder kan det ogs\u00e5 f\u00f8re til beskadigelse af UEFI-firmware hukommelsesomr\u00e5det, hvilket potentielt muligg\u00f8r udf\u00f8relse af brugerdefineret kode p\u00e5 bootloader- eller firmware-niveau. <\/p>\n

Desuden er der ogs\u00e5 identificeret en anden s\u00e5rbarhed i NTFS-driveren fra GRUB2 (CVE-2023-4693), som g\u00f8r det muligt at l\u00e6se indholdet af vilk\u00e5rlige hukommelsesomr\u00e5der ved parsing af attributten «$DATA» i et specifikt format NTFS-billede. Blandt andet g\u00f8r s\u00e5rbarheden det muligt at udtr\u00e6kke fortrolige data, der er cachelagret i hukommelsen, eller bestemme v\u00e6rdierne for EFI-variabler. <\/p>\n

Problemerne er hidtil kun blevet l\u00f8st i form af en patch. Status for udbedring af s\u00e5rbarheder i distributioner kan vurderes p\u00e5 f\u00f8lgende sider: Debian, Ubuntu, SUSE, RHEL, Fedora. For at l\u00f8se problemerne i GRUB2 er det ikke nok kun at opdatere pakken; det er ogs\u00e5 n\u00f8dvendigt at generere nye interne digitale signaturer og opdatere installat\u00f8rer, bootloadere, kernpakker, fwupd-firmware og shim-laget. <\/p>\n

I de fleste Linux-distributioner bruges et lille lag shim, som er digitalt signeret af Microsoft, til verifikation af opstart i UEFI Secure Boot-tilstand. Dette lag verificerer GRUB2 med sin egen certifikat, hvilket giver distribut\u00f8rerne mulighed for ikke at skulle godkende hver opdatering af kerne og GRUB hos Microsoft. S\u00e5rbarheder i GRUB2 g\u00f8r det muligt at udf\u00f8re sin egen kode efter en vellykket verifikation af shim, men f\u00f8r operativsystemet er indl\u00e6st, ved at tr\u00e6nge ind i tillidsk\u00e6den under aktiv Secure Boot-tilstand og f\u00e5 fuld kontrol over den videre opstartsproces, for eksempel til at indl\u00e6se et andet OS, modificere komponenter i operativsystemet og omg\u00e5 Lockdown-beskyttelsen. <\/p>\n

For at blokere s\u00e5rbarheden uden at tilbagekalde den digitale signatur kan distributionerne anvende mekanismen SBAT (UEFI Secure Boot Advanced Targeting), som underst\u00f8ttes af GRUB2, shim og fwupd i de fleste popul\u00e6re Linux-distributioner. SBAT er udviklet i samarbejde med Microsoft og indeb\u00e6rer tilf\u00f8jelse af metadata til UEFI-komponenternes eksekverbare filer, som inkluderer oplysninger om producent, produkt, komponent og version. De n\u00e6vnte metadata signeres digitalt og kan separat inkluderes i lister over tilladte eller forbudte komponenter til UEFI Secure Boot. <\/p>\n

SBAT giver mulighed for at blokere anvendelsen af digitale signaturer for specifikke versioner af komponenter uden behov for at tilbagekalde n\u00f8gler til Secure Boot. Blokering af s\u00e5rbarheder gennem SBAT kr\u00e6ver ikke brug af listen over tilbagekaldte UEFI-certifikater (dbx), men udf\u00f8res p\u00e5 niveauet for udskiftning af den interne n\u00f8gle til dannelse af signaturer og opdatering af GRUB2, shim og andre leverede distributionsbootartefakter. Inden indf\u00f8relsen af SBAT var opdatering af listen over tilbagekaldte certifikater (dbx, UEFI Revocation List) en obligatorisk betingelse for fuldst\u00e6ndig blokering af s\u00e5rbarheden, da en angriber, uanset hvilket operativsystem der blev brugt, kunne udnytte bootloaderen til at kompromittere UEFI Secure Boot.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 NTFS \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-4692), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u043e\u0431\u0440\u0430\u0437\u0443 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043a\u043e\u0434\u0435 \u0440\u0430\u0437\u0431\u043e\u0440\u0430 NTFS-\u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0430 «$ATTRIBUTE_LIST» (grub-core\/fs\/ntfs.c), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110421","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhed i NTFS-driveren fra GRUB2, der muligg\u00f8r udf\u00f8relse af kode og omg\u00e5else af UEFI Secure Boot | ProHoster","description":"I driveren, der muligg\u00f8r interaktionen med NTFS-filsystemet i bootloaderen GRUB2, er der identificeret en s\u00e5rbarhed (CVE-2023-4692), som tillader udf\u00f8relse af brugerdefineret kode p\u00e5 bootloader-niveau, n\u00e5r der tilg\u00e5s specifikt.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 NTFS-\u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435 \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 GRUB2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 UEFI Secure Boot | ProHoster","og:description":"\u0412 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 NTFS \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-4692), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-04T07:10:18+00:00","article:modified_time":"2023-10-04T07:10:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/110421","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=110421"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/110421\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=110421"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=110421"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=110421"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}