A Linux kernel vulnerability (CVE-2022-21505) has been identified, allowing easy bypassing of the Lockdown security mechanism that restricts root user access to the kernel and blocks UEFI Secure Boot bypass paths. The suggested method for bypassing involves using the IMA (Integrity Measurement Architecture) kernel subsystem, which is designed to verify the integrity of operating system components through digital signatures and hashes.
In lockdown mode, access to /dev/mem, /dev/kmem, /dev/port, /proc/kcore, debugfs, the kprobes debug mode, mmiotrace, tracefs, BPF, PCMCIA CIS (Card Information Structure), certain ACPI interfaces, and CPU MSR registers is restricted. Calls to kexec_file and kexec_load are blocked, sleep mode transitions are prohibited, DMA usage for PCI devices is limited, importing ACPI code from EFI variables is forbidden, and manipulation of input/output ports is not allowed, including changing the interrupt number and input/output port for the serial port.
The essence of the vulnerability is that using the boot parameter "ima_appraise=log" allows invoking kexec to boot a new kernel copy if Secure Boot is not active and Lockdown mode is used separately from it. IMA does not permit enabling the "ima_appraise" mode when Secure Boot is active, but it does not consider the possibility of using Lockdown independently from Secure Boot.
Forrás: opennet.ru
