Des informations concernant 21 vuln\u00e9rabilit\u00e9s dans le chargeur GRUB2 ont \u00e9t\u00e9 publi\u00e9es, dont la majorit\u00e9 entra\u00eenent un d\u00e9bordement de tampon et peuvent \u00eatre exploit\u00e9es pour contourner le m\u00e9canisme de v\u00e9rification du d\u00e9marrage s\u00e9curis\u00e9 UEFI. Les probl\u00e8mes ont seulement \u00e9t\u00e9 corrig\u00e9s sous forme de patch pour l'instant. L'\u00e9tat de la correction des vuln\u00e9rabilit\u00e9s dans les distributions peut \u00eatre \u00e9valu\u00e9 sur les pages suivantes : Debian, Ubuntu, SUSE, RHEL, Fedora. Pour rem\u00e9dier aux probl\u00e8mes dans GRUB2, il ne suffit pas de mettre \u00e0 jour le paquet ; il faut \u00e9galement g\u00e9n\u00e9rer de nouvelles signatures num\u00e9riques internes et proc\u00e9der \u00e0 la mise \u00e0 jour des installateurs, des chargeurs, des paquets de noyau, des firmwares fwupd et de la couche shim. <\/p>\n
Vuln\u00e9rabilit\u00e9s identifi\u00e9es : <\/p>\n
Dans la plupart des distributions Linux, un petit interm\u00e9diaire appel\u00e9 shim, sign\u00e9 num\u00e9riquement par Microsoft, est utilis\u00e9 pour le d\u00e9marrage s\u00e9curis\u00e9 en mode UEFI. Cet interm\u00e9diaire v\u00e9rifie GRUB2 avec son propre certificat, ce qui permet aux d\u00e9veloppeurs de distributions de ne pas avoir \u00e0 certifier chaque mise \u00e0 jour du noyau et de GRUB aupr\u00e8s de Microsoft. Les vuln\u00e9rabilit\u00e9s de GRUB2 permettent d'ex\u00e9cuter son propre code apr\u00e8s la v\u00e9rification r\u00e9ussie de shim, mais avant le chargement du syst\u00e8me d'exploitation, en s'infiltrant dans la cha\u00eene de confiance en mode Secure Boot actif et en prenant le contr\u00f4le total du processus de d\u00e9marrage, par exemple pour charger un autre syst\u00e8me d'exploitation, modifier des composants du syst\u00e8me d'exploitation et contourner la protection Lockdown. <\/p>\n
Pour bloquer la vuln\u00e9rabilit\u00e9 sans r\u00e9voquer la signature num\u00e9rique, les distributions peuvent utiliser le m\u00e9canisme SBAT (UEFI Secure Boot Advanced Targeting), dont le support est mis en \u0153uvre pour GRUB2, shim et fwupd dans la plupart des distributions Linux populaires. SBAT a \u00e9t\u00e9 d\u00e9velopp\u00e9 en collaboration avec Microsoft et implique l'ajout de m\u00e9tadonn\u00e9es suppl\u00e9mentaires aux fichiers ex\u00e9cutables des composants UEFI, incluant des informations sur le fabricant, le produit, le composant et la version. Ces m\u00e9tadonn\u00e9es sont sign\u00e9es num\u00e9riquement et peuvent \u00eatre incluses s\u00e9par\u00e9ment dans des listes de composants autoris\u00e9s ou interdits pour le d\u00e9marrage s\u00e9curis\u00e9 UEFI. <\/p>\n
SBAT permet de bloquer l'utilisation d'une signature num\u00e9rique pour des num\u00e9ros de version sp\u00e9cifiques des composants sans avoir \u00e0 r\u00e9voquer les cl\u00e9s pour le Secure Boot. Le blocage des vuln\u00e9rabilit\u00e9s via SBAT ne n\u00e9cessite pas l'utilisation d'une liste de certificats r\u00e9voqu\u00e9s UEFI (dbx), mais se r\u00e9alise au niveau du remplacement de la cl\u00e9 interne pour la g\u00e9n\u00e9ration des signatures et la mise \u00e0 jour de GRUB2, shim et d'autres artefacts de d\u00e9marrage fournis par les distributions. Avant l'impl\u00e9mentation du SBAT, la mise \u00e0 jour de la liste des certificats r\u00e9voqu\u00e9s (dbx, UEFI Revocation List) \u00e9tait une condition pr\u00e9alable pour bloquer compl\u00e8tement la vuln\u00e9rabilit\u00e9, car un attaquant, quelle que soit la version du syst\u00e8me d'exploitation utilis\u00e9e, pouvait compromettre le d\u00e9marrage s\u00e9curis\u00e9 UEFI en utilisant un support de d\u00e9marrage avec une ancienne version vuln\u00e9rable de GRUB2 sign\u00e9e num\u00e9riquement. \u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e 21 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u043e\u043a\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u0438\u0434\u0435 \u043f\u0430\u0442\u0447\u0430. \u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u043c\u043e\u0436\u043d\u043e \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u043d\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430\u0445: Debian, Ubuntu, SUSE, RHEL, Fedora. \u0414\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0432 GRUB2 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-122049","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd4721 vuln\u00e9rabilit\u00e9s d\u00e9tect\u00e9es dans le chargeur GRUB2 | ProHoster","description":"Des informations sur 21 vuln\u00e9rabilit\u00e9s dans le chargeur GRUB2 ont \u00e9t\u00e9 publi\u00e9es, dont la plupart entra\u00eenent un d\u00e9passement de tampon et peuvent \u00eatre utilis\u00e9es pour contourner le m\u00e9canisme de v\u00e9rification de d\u00e9marrage UEFI Secure Boot.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-zagruzchike-grub2-vyyavlena-21-uyazvimost","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 21 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e 21 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-zagruzchike-grub2-vyyavlena-21-uyazvimost","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-22T00:22:05+00:00","article:modified_time":"2025-02-22T00:22:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"122049","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 10:50:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:50:19","updated":"2026-01-23 10:50:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/122049","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=122049"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/122049\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=122049"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=122049"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=122049"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"