In the GRUB2 bootloader 8 vulnerabilities. The most dangerous (), codenamed BootHole, bypassing the UEFI Secure Boot mechanism and achieving the installation of unverified malware. A unique aspect of this vulnerability is that simply updating GRUB2 is insufficient, as an attacker can use a bootable medium with an old vulnerable version that is signed with a digital signature. The attacker can compromise the verification process not only for Linux but also for other operating systems, including .
The issue is resolved only by updating the (dbx, UEFI Revocation List), but in this case, the ability to use old installation media with Linux will be lost. Some hardware manufacturers have already included an updated list of revoked certificates in their firmware, allowing only updated builds of Linux distributions to boot in UEFI Secure Boot mode on such systems.
To eliminate the vulnerability in distributions, it is also necessary to update installers, bootloaders, kernel packages, fwupd firmware, and the shim layer by generating new digital signatures for them. Users will need to update installation images and other bootable media, as well as load the revoked certificates list (dbx) into the UEFI firmware. Until the dbx is updated in UEFI, the system remains vulnerable regardless of whether updates are installed in the OS.
The vulnerability buffer overflow, which can be exploited to execute arbitrary code during the boot process.
The vulnerability manifests during the parsing of the grub.cfg configuration file, which is typically located in the ESP (EFI System Partition) and can be edited by an attacker with administrator rights without compromising the integrity of the signed executable files for shim and GRUB2. Due to a coding error in the configuration parser, the fatal parsing error handler YY_FATAL_ERROR only issued a warning but did not terminate the program. The danger of the vulnerability is mitigated by the necessity of privileged access to the system; nonetheless, the issue may become relevant for implementing hidden rootkits if physical access to the hardware is available (if booting from their own medium is possible).
In most Linux distributions, a small , certified with a digital signature from Microsoft. This layer verifies GRUB2 with its own certificate, allowing distribution developers not to certify every kernel and GRUB update with Microsoft. The vulnerability allows for code execution after the successful verification of shim but before the operating system boots, interfering with the trust chain while Secure Boot is active and gaining full control over the subsequent boot process, including loading another OS, modifying OS components, and bypassing protections. .
Other vulnerabilities in GRUB2:
- — buffer overflow due to lack of size check in grub_malloc;
- — integer overflow in grub_squash_read_symlink, which could lead to writing data outside the allocated buffer;
- — integer overflow in read_section_from_string, which could lead to writing data outside the allocated buffer;
- — integer overflow in grub_ext2_read_link, which could lead to writing data outside the allocated buffer;
- — allows loading unsigned kernels during direct boot in Secure Boot mode without the shim layer;
- — use-after-free when overriding a function during execution;
- — integer overflow in the initrd size handler.
Patch updates have been released for , , and . For GRUB2 a set of patches.
Source: opennet.ru
