{"id":110421,"date":"2023-10-04T09:10:18","date_gmt":"2023-10-04T07:10:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot"},"modified":"2023-10-04T09:10:18","modified_gmt":"2023-10-04T07:10:18","slug":"uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","title":{"rendered":"Haavatavus GRUB2 NTFS draiveris, mis v\u00f5imaldab koodi k\u00e4ivitada ja UEFI Secure Boot'i v\u00e4ltida","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GRUB2 laadijaga t\u00f6\u00f6tava NTFS-failis\u00fcsteemi draiveris tuvastati haavatavus (CVE-2023-4692), mis v\u00f5imaldab laadija tasandil oma koodi k\u00e4ivitada, kui p\u00f6\u00f6rduda spetsiaalselt kujundatud failis\u00fcsteemi pildi poole. Seda haavatavust saab kasutada UEFI Secure Boot'i allkirjastatud k\u00e4ivitamismehhanismi \u00fcmbersuunamiseks. <\/p>\n

Haava tuleneb veast NTFS atribuutide parsimis koodis «$ATTRIBUTE_LIST» (grub-core\/fs\/ntfs.c), mida saab kasutada kasutaja kontrollitava teabe kirjutamiseks m\u00e4lu alale, mis \u00fcletab eraldatud puhvrit. Spetsiaalselt vormindatud NTFS pildi t\u00f6\u00f6tlemise k\u00e4igus p\u00f5hjustab \u00fclevool partei m\u00e4lu GRUB-is, samuti, teatud tingimustel, UEFI p\u00fcsivara m\u00e4lu alade r\u00fc\u00fcstamise, mis v\u00f5ib potentsiaalselt v\u00f5imaldada oma koodi t\u00e4itmist bootloaderi v\u00f5i p\u00fcsivara tasemel. <\/p>\n

Lisaks on GRUB2 NTFS draiveris avastatud veel \u00fcks haavatavus (CVE-2023-4693), mis v\u00f5imaldab lugeda meelevaldse m\u00e4lu ala sisu, kui parsitakse «$DATA» atribuuti spetsiaalselt vormindatud NTFS pildis. Muuhulgas v\u00f5imaldab haavatavus v\u00e4lja v\u00f5tta konfidentsiaalseid andmeid, mis on m\u00e4lu vahem\u00e4lus, v\u00f5i m\u00e4\u00e4rata EFI muutujate v\u00e4\u00e4rtusi. <\/p>\n

Probleemid on seni lahendatud ainult plaastri n\u00e4ol. Haavatavuste k\u00f5rvaldamise staatus distributsioonides on hinnatav j\u00e4rgmiste lehek\u00fclgede andmetel: Debian, Ubuntu, SUSE, RHEL, Fedora. GRUB2 probleemide lahendamiseks ei piisa lihtsalt paketi uuendamisest; on vajalik ka uusi sisemisi digitaalseid allkirju genereerida ning uuendada installijat, laadijat, tuumapakette, fwupd-p\u00fcsivara ja shim-kihte. <\/p>\n

In most Linux distributions, a small shim layer, signed by Microsoft, is used for verified boot in UEFI Secure Boot mode. This shim verifies GRUB2 with its own certificate, allowing distribution developers to avoid signing every kernel and GRUB update with Microsoft. Vulnerabilities in GRUB2 can enable code execution after the successful verification of the shim, but before the operating system is loaded, infiltrating the trust chain while Secure Boot is active and gaining full control over the boot process, allowing for loading another OS, modifying operating system components, and bypassing Lockdown protection. <\/p>\n

Kuna digitaalallkirja t\u00fchistamiseta haavatavuste blokeerimiseks v\u00f5ivad jaotised kasutada mehhanismi SBAT (UEFI Secure Boot Advanced Targeting), mille tugi on rakendatud GRUB2, shim ja fwupd enamikes tuntud Linuxi jaotustes. SBAT on v\u00e4lja t\u00f6\u00f6tatud koost\u00f6\u00f6s Microsoftiga ja h\u00f5lmab UEFI komponente sisaldavate esitamisfailide t\u00e4iendavate metaandmete lisamist, mis sisaldavad teavet tootja, toote, komponendi ja versiooni kohta. Loomulikult alla kirjutatud metaandmed v\u00f5ivad eraldi kuuluda lubatud v\u00f5i keelatud komponentide loenditesse UEFI Secure Boot jaoks. <\/p>\n

SBAT v\u00f5imaldab blokeerida digitaalse allkirja kasutamist \u00fcksikute komponentide versioonide numbrite jaoks ilma vajaduseta tagasi kutsuda v\u00f5tmeid Secure Boot'i jaoks. SBAT kaudu haavatavuste blokeerimine ei n\u00f5ua UEFI (dbx) t\u00fchistatud sertifikaatide nimekirja kasutamist, vaid toimub sisemise v\u00f5tme asendamise tasemel allkirjade genereerimiseks ning GRUB2, shim ja teiste tarnitud distributsioonide k\u00e4ivitusartefaktide uuendamiseks. Enne SBAT'i kasutuselev\u00f5ttu oli t\u00fchistatud sertifikaatide nimekirja (dbx, UEFI Revocation List) uuendamine t\u00e4ieliku haavatavuse blokeerimise aluseks, kuna r\u00fcndaja, s\u00f5ltumata kasutatavast operatsioonis\u00fcsteemist, sai UEFI Secure Boot'i kompromiteerimiseks kasutada k\u00e4ivitus
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 NTFS \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-4692), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u043e\u0431\u0440\u0430\u0437\u0443 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043a\u043e\u0434\u0435 \u0440\u0430\u0437\u0431\u043e\u0440\u0430 NTFS-\u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0430 «$ATTRIBUTE_LIST» (grub-core\/fs\/ntfs.c), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110421","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GRUB2-s oleva NTFS-draiveri haavatavus, mis v\u00f5imaldab koodi k\u00e4ivitamist ja UEFI Secure Boot'ist m\u00f6\u00f6da hiilimist | ProHoster","description":"GRUB2 k\u00e4ivitusprogrammi NTFS-failis\u00fcsteemiga t\u00f6\u00f6tava draiveri kaudu leiti haavatavus (CVE-2023-4692), mis v\u00f5imaldab k\u00e4ivitada oma koodi k\u00e4ivitusprogrammi tasemel, kui sellele p\u00f6\u00f6rduda spetsiaalselt.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 NTFS-\u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435 \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 GRUB2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 UEFI Secure Boot | ProHoster","og:description":"\u0412 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 NTFS \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-4692), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-04T07:10:18+00:00","article:modified_time":"2023-10-04T07:10:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/110421","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=110421"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/110421\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=110421"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=110421"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=110421"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}