{"id":104320,"date":"2022-06-08T15:36:43","date_gmt":"2022-06-08T13:36:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-grub2-pozvolyayushhie-obojti-uefi-secure-boot"},"modified":"2022-06-08T15:36:43","modified_gmt":"2022-06-08T13:36:43","slug":"uyazvimosti-v-grub2-pozvolyayushhie-obojti-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-grub2-pozvolyayushhie-obojti-uefi-secure-boot","title":{"rendered":"A GRUB2-ben tal\u00e1lhat\u00f3 sebezhet\u0151s\u00e9gek lehet\u0151v\u00e9 teszik az UEFI Secure Boot megker\u00fcl\u00e9s\u00e9t","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A GRUB2 bootloader patch has addressed 7 vulnerabilities that allow bypassing the UEFI Secure Boot mechanism, enabling the execution of unverified code, such as the injection of malware operating at the bootloader or kernel level. Additionally, there is one vulnerability in the shim layer that also allows bypassing UEFI Secure Boot. This group of vulnerabilities is codenamed Boothole 3, similar to previously identified issues in the bootloader. <\/p>\n
To resolve issues in GRUB2 and shim, distributions will be able to use the SBAT (UEFI Secure Boot Advanced Targeting) mechanism, which is supported for GRUB2, shim, and fwupd. SBAT has been developed in collaboration with Microsoft and involves adding additional metadata to the executable files of UEFI components, which includes information on manufacturer, product, component, and version. These metadata are digitally signed and can separately be included in the lists of allowed or disallowed components for UEFI Secure Boot. <\/p>\n
In most Linux distributions, a small shim layer, signed by Microsoft's digital signature, is used for verified boot in UEFI Secure Boot mode. This shim verifies GRUB2 with its own certificate, allowing distribution developers not to sign every kernel and GRUB update with Microsoft. Vulnerabilities in GRUB2 enable the execution of one's code at the stage after successful shim verification but before the operating system loads, intercepting the trust chain while Secure Boot is active and gaining full control over the subsequent boot process, including booting another OS, modifying operating system components, and bypassing Lockdown protection. <\/p>\n
To resolve issues in the bootloader, distributions will need to generate new internal digital signatures and update installers, bootloaders, kernel packages, fwupd firmware, and the shim layer. Prior to the adoption of SBAT, updating the list of revoked certificates (dbx, UEFI Revocation List) was a mandatory condition for fully blocking the vulnerability, as an attacker, regardless of the operating system used, could compromise UEFI Secure Boot using a bootable medium with an old vulnerable version of GRUB2, signed with a digital signature. <\/p>\n
A SBAT al\u00e1\u00edr\u00e1sa lehet\u0151v\u00e9 teszi az egyes verzi\u00f3sz\u00e1m\u00fa komponensek haszn\u00e1lat\u00e1nak letilt\u00e1s\u00e1t an\u00e9lk\u00fcl, hogy vissza kellene vonni a Secure Boot kulcsait. Az SBAT r\u00e9v\u00e9n t\u00f6rt\u00e9n\u0151 sebezhet\u0151s\u00e9gek letilt\u00e1sa nem ig\u00e9nyel UEFI visszavont tan\u00fas\u00edtv\u00e1nyok list\u00e1j\u00e1nak (dbx) haszn\u00e1lat\u00e1t, mivel a bels\u0151 kulcs cser\u00e9j\u00e9nek szintj\u00e9n t\u00f6rt\u00e9nik az al\u00e1\u00edr\u00e1sok l\u00e9trehoz\u00e1sa \u00e9s a GRUB2, shim \u00e9s m\u00e1s, forgalmaz\u00f3kt\u00f3l sz\u00e1rmaz\u00f3 ind\u00edt\u00f3 artefaktumok friss\u00edt\u00e9se. Jelenleg a legt\u00f6bb n\u00e9pszer\u0171 Linux disztrib\u00faci\u00f3 m\u00e1r t\u00e1mogatja az SBAT-ot. <\/p>\n
Felt\u00e1rt sebezhet\u0151s\u00e9gek: <\/p>\n
\n
CVE-2021-3696, CVE-2021-3695 - puffert\u00falfoly\u00e1s a heap-en kifejezetten form\u00e1zott PNG-k\u00e9pek feldolgoz\u00e1sa sor\u00e1n, amely elm\u00e9letileg felhaszn\u00e1lhat\u00f3 a t\u00e1mad\u00f3 k\u00f3dj\u00e1nak v\u00e9grehajt\u00e1s\u00e1ra \u00e9s az UEFI Secure Boot megker\u00fcl\u00e9s\u00e9re. Megjegyzend\u0151, hogy a probl\u00e9ma nehezen kihaszn\u00e1lhat\u00f3, mivel a m\u0171k\u00f6d\u0151 exploit l\u00e9trehoz\u00e1s\u00e1hoz sz\u00e1mos t\u00e9nyez\u0151 figyelembev\u00e9tel\u00e9re \u00e9s a mem\u00f3riaelrendez\u00e9s ismeret\u00e9re van sz\u00fcks\u00e9g.\n
CVE-2021-3697 - als\u00f3 hat\u00e1ron t\u00f6rt\u00e9n\u0151 puffert\u00falfoly\u00e1s JPEG-k\u00e9pek feldolgoz\u00e1sa k\u00f6zben. A hiba kihaszn\u00e1l\u00e1s\u00e1hoz a mem\u00f3riaelrendez\u00e9s ismerete sz\u00fcks\u00e9ges, \u00e9s nagyj\u00e1b\u00f3l ugyanolyan bonyolult, mint a PNG probl\u00e9m\u00e1ja (CVSS 7.5).\n
CVE-2022-28733 \u2014 eg\u00e9sz sz\u00e1mok t\u00falt\u00f6lt\u00e9se a grub_net_recv_ip4_packets() f\u00fcggv\u00e9nyben, amely lehet\u0151v\u00e9 teszi a rsm->total_len param\u00e9ter befoly\u00e1sol\u00e1s\u00e1t k\u00fcl\u00f6nlegesen form\u00e1zott IP-csomagok k\u00fcld\u00e9s\u00e9vel. A probl\u00e9ma a legvesz\u00e9lyesebbnek min\u0151s\u00edtett sebezhet\u0151s\u00e9gek k\u00f6z\u00f6tt szerepel (CVSS 8.1). A sebezhet\u0151s\u00e9g sikeres kihaszn\u00e1l\u00e1sa lehet\u0151v\u00e9 teszi az adatok \u00edr\u00e1s\u00e1t a puffer hat\u00e1rain t\u00fal, a sz\u00e1nd\u00e9kosan kisebb m\u00e9ret\u0171 mem\u00f3ria lefoglal\u00e1s\u00e1val.\n
CVE-2022-28734 \u2014 egy b\u00e1jt t\u00falt\u00f6lt\u00e9se a sz\u00e9tv\u00e1lasztott HTTP-fejl\u00e9cek feldolgoz\u00e1sa sor\u00e1n. A probl\u00e9ma a GRUB2 metaadatainak s\u00e9r\u00fcl\u00e9s\u00e9hez vezethet (nulla b\u00e1jt \u00edr\u00e1sa k\u00f6zvetlen\u00fcl a puffer v\u00e9g\u00e9re) k\u00fcl\u00f6nlegesen form\u00e1zott HTTP-k\u00e9r\u00e9sek elemz\u00e9sekor.\n
CVE-2022-28735 \u2014 probl\u00e9ma a shim_lock ellen\u0151rz\u0151ben, amely lehet\u0151v\u00e9 teszi nem kernelhez tartoz\u00f3 f\u00e1jlok bet\u00f6lt\u00e9s\u00e9t. A sebezhet\u0151s\u00e9g kihaszn\u00e1lhat\u00f3 UEFI Secure Boot m\u00f3dban nem al\u00e1\u00edrt digit\u00e1lis al\u00e1\u00edr\u00e1ssal rendelkez\u0151 kernelmodulok vagy ellen\u0151rizetlen k\u00f3d bet\u00f6lt\u00e9s\u00e9re.\n
CVE-2022-28736 \u2014 m\u00e1r felszabad\u00edtott mem\u00f3ria ter\u00fclethez val\u00f3 hozz\u00e1f\u00e9r\u00e9s a grub_cmd_chainloader() f\u00fcggv\u00e9nyben a chainloader parancs \u00fajraind\u00edt\u00e1s\u00e1n kereszt\u00fcl, amelyet nem t\u00e1mogatott oper\u00e1ci\u00f3s rendszerek bet\u00f6lt\u00e9s\u00e9re haszn\u00e1lnak a GRUB2-ben. A kihaszn\u00e1l\u00e1s k\u00f3dv\u00e9grehajt\u00e1shoz vezethet, ha a t\u00e1mad\u00f3 k\u00e9pes meghat\u00e1rozni a mem\u00f3riaeloszt\u00e1s saj\u00e1toss\u00e1gait a GRUB2-ben.\n
CVE-2022-28737 \u2014 puffer t\u00falt\u00f6lt\u00e9s a shim r\u00e9tegben, amely a handle_image() f\u00fcggv\u00e9nyben fordul el\u0151, amikor k\u00fcl\u00f6nlegesen form\u00e1zott EFI k\u00e9pek bet\u00f6lt\u00e9se \u00e9s v\u00e9grehajt\u00e1sa t\u00f6rt\u00e9nik. <\/ul>\n