{"id":112924,"date":"2024-01-15T17:28:03","date_gmt":"2024-01-15T15:28:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-patchah-red-hat-k-zagruzchiku-grub2-pozvolyayushhaya-obojti-proverku-parolya"},"modified":"2024-01-15T17:28:03","modified_gmt":"2024-01-15T15:28:03","slug":"uyazvimost-v-patchah-red-hat-k-zagruzchiku-grub2-pozvolyayushhaya-obojti-proverku-parolya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-patchah-red-hat-k-zagruzchiku-grub2-pozvolyayushhaya-obojti-proverku-parolya","title":{"rendered":"A vulnerability in Red Hat patches for the GRUB2 bootloader that allows bypassing password verification.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Information has been revealed about the vulnerability (CVE-2023-4001) in patches for the GRUB2 bootloader prepared by Red Hat. This vulnerability allows bypassing the password check set in GRUB2 to limit access to the boot menu or command line on many systems with UEFI. The issue stems from a modification added by Red Hat to the GRUB2 package provided in RHEL and Fedora Linux. The problem does not affect the main GRUB2 project and only impacts distributions that have applied additional Red Hat patches. <\/p>\n
The issue is caused by an error in the logic of using UUID for the bootloader to search for the configuration file (for example, \"\/boot\/efi\/EFI\/fedora\/grub.cfg\"), which contains a password hash. To bypass authentication, a user with physical access to the computer can connect an external storage device, such as a USB Flash drive, assigning it a UUID that duplicates the identifier of the boot partition \/boot of the attacked system. <\/p>\n
Many UEFI systems primarily process external storage devices and place them higher in the detected devices list than internal ones. Therefore, the boot partition prepared by the attacker will be given priority, and GRUB2 will attempt to load the configuration file from that partition. During the search for the partition using the \"search\" command in GRUB2, only the first matching UUID is identified, after which the search stops. If the main configuration file is not found in a particular partition, GRUB2 will display a command prompt, allowing full control over the boot process. <\/p>\n
A local unprivileged user can use the \"lsblk\" utility to determine the UUID of the partition, but an external user without access to the system, who can observe the boot process, may determine the UUID from the diagnostic messages displayed during boot on certain distributions. The vulnerability was mitigated by Red Hat through the addition of a new argument to the \"search\" command, allowing the scanning operation for UUIDs to be restricted only to block devices used for launching the boot manager (i.e., the \/boot partition must be on the same disk as the EFI system partition). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"