{"id":110421,"date":"2023-10-04T09:10:18","date_gmt":"2023-10-04T07:10:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot"},"modified":"2023-10-04T09:10:18","modified_gmt":"2023-10-04T07:10:18","slug":"uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","title":{"rendered":"Ranljivost u NTFS voza\u010du koji je dio GRUB2, koja omogu\u0107uje izvr\u0161avanje koda i zaobila\u017eenje UEFI Secure Bootea","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

U driveru koji omogu\u0107uje rad s datote\u010dnim sustavom NTFS u GRUB2 bootloaderu otkrivena je ranjivost (CVE-2023-4692) koja omogu\u0107uje izvr\u0161avanje korisni\u010dkog koda na razini bootloadera kada se pristupa posebno oblikovanoj slici datote\u010dnog sustava. Ranjivost se mo\u017ee iskoristiti za zaobila\u017eenje mehanizma provjere autenti\u010dnosti UEFI Secure Boot. <\/p>\n

Ranljivost je uzrokovana gre\u0161kom u kodu za razdvajanje NTFS atribute «$ATTRIBUTE_LIST» (grub-core\/fs\/ntfs.c), koju se mo\u017ee iskoristiti za pisanje korisni\u010dki kontroliranih informacija u podru\u010dje memorije izvan dodijeljenog bafera. Prilikom obrade posebno oblikovane NTFS slike, preljevanje dovodi do prepisivanja dijela memorije GRUB-a, a tako\u0111er, pod odre\u0111enim uvjetima, do o\u0161te\u0107enja podru\u010dja memorije UEFI firmvera, \u0161to potencijalno omogu\u0107uje izvr\u0161avanje vlastitog koda na razini pokreta\u010da ili firmvera. <\/p>\n

Osim toga, u NTFS drajveru iz GRUB2 tako\u0111er je otkrivena jo\u0161 jedna ranljivost (CVE-2023-4693), koja omogu\u0107ava \u010ditanje sadr\u017eaja proizvoljnog podru\u010dja memorije prilikom razdvajanja atributa «$DATA» u posebno oblikovanoj NTFS slici. Izme\u0111u ostalog, ranljivost omogu\u0107ava va\u0111enje povjerljivih podataka, ke\u0161iranih u memoriji, ili odre\u0111ivanje vrijednosti EFI varijabli. <\/p>\n

Problemi su za sada otklonjeni samo u obliku zakrpe. Status otklanjanja ranjivosti u distribucijama mo\u017ee se ocijeniti na sljede\u0107im stranicama: Debian, Ubuntu, SUSE, RHEL, Fedora. Za otklanjanje problema u GRUB2 nije dovoljno samo a\u017eurirati paket; potrebno je tako\u0111er stvoriti nove unutarnje digitalne potpise i a\u017eurirati instalacijske programe, bootloadere, pakete s kernelom, fwupd firmware i shim sloj. <\/p>\n

U ve\u0107ini Linux distribucija, za verifikovano pokretanje u UEFI Secure Boot re\u017eimu koristi se mala slojevitost shim, koju je potpisala Microsoftova digitalna potpis. Ova slojevitost verifikuje GRUB2 vlastitim certifikatom, \u0161to omogu\u0107ava razvija\u010dima distribucija da ne potpisuju svaku nadogradnju jezgra i GRUB kod Microsofta. Ranjenosti u GRUB2 omogu\u0107uju izvr\u0161avanje koda nakon uspe\u0161ne verifikacije shima, ali pre pokretanja operativnog sistema, upadaju\u0107i u lanac poverenja tokom aktivnog re\u017eima Secure Boot i sti\u010du\u0107i potpunu kontrolu nad daljnjim procesom pokretanja, na primer, za pokretanje drugog operativnog sistema, modifikaciju komponenti operativnog sistema i zaobila\u017eenje za\u0161tite Lockdown. <\/p>\n

Za blokiranje ranjivosti bez opoziva digitalne potpise, distribucije mogu koristiti mehanizam SBAT (UEFI Secure Boot Advanced Targeting), \u010dija podr\u0161ka je implementirana za GRUB2, shim i fwupd u ve\u0107ini popularnih Linux distribucija. SBAT je razvijen u saradnji s Microsoftom i podrazumeva dodavanje dodatnih metapodataka u izvr\u0161ne datoteke UEFI komponenti, koji uklju\u010duju informacije o proizvo\u0111a\u010du, proizvodu, komponenti i verziji. Ovi metapodaci su potpisani digitalnom potpisom i mogu biti odvojeno uklju\u010deni u liste dozvoljenih ili zabranjenih komponenti za UEFI Secure Boot. <\/p>\n

SBAT omogu\u0107uje blokiranje kori\u0161tenja digitalnog potpisa za pojedine verzije komponenti bez potrebe za opozivanjem klju\u010deva za Secure Boot. Blokiranje ranjivosti putem SBAT-a ne zahtijeva kori\u0161tenje popisa opozvanih UEFI certifikata (dbx), ve\u0107 se provodi na razini zamjene unutarnjeg klju\u010da za formiranje potpisa i a\u017euriranje GRUB2, shim i drugih isporu\u010denih distribucija pokreta\u010dkih artefakata. Prije uvo\u0111enja SBAT-a, a\u017euriranje popisa opozvanih certifikata (dbx, UEFI Revocation List) bilo je obvezno za potpuno blokiranje ranjivosti, jer je napada\u010d, bez obzira na kori\u0161teni operativni sustav, mogao iskoristiti podizanje sustava za kompromitaciju UEFI Secure Boot.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 NTFS \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-4692), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u043e\u0431\u0440\u0430\u0437\u0443 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043a\u043e\u0434\u0435 \u0440\u0430\u0437\u0431\u043e\u0440\u0430 NTFS-\u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0430 «$ATTRIBUTE_LIST» (grub-core\/fs\/ntfs.c), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110421","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranjivost u NTFS drajveru koji dolazi s GRUB2, koja omogu\u0107ava izvr\u0161enje koda i zaobila\u017eenje UEFI Secure Boot | ProHoster","description":"U drajveru koji omogu\u0107uje rad s NTFS datote\u010dnim sustavom u GRUB2 pokreta\u010du otkrivena je ranjivost (CVE-2023-4692) koja omogu\u0107ava izvr\u0161enje vlastitog koda na razini pokreta\u010da prilikom pristupa specijalnim.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 NTFS-\u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435 \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 GRUB2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 UEFI Secure Boot | ProHoster","og:description":"\u0412 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 NTFS \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-4692), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-04T07:10:18+00:00","article:modified_time":"2023-10-04T07:10:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/110421","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=110421"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/110421\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=110421"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=110421"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=110421"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}