A Shim layer used in most Linux distributions for verified boot in UEFI Secure Boot mode has a vulnerability (CVE-2023-40547) that could allow remote code execution and bypass the UEFI Secure Boot mechanism. An attacker controlling the HTTP server that Shim accesses can return a specially crafted response, leading to controlled write operations outside the buffer area to execute code early in the boot process. <\/p>\n
A sebezhet\u0151s\u00e9g egy HTTP f\u00e1jlok bet\u00f6lt\u00e9s\u00e9vel kapcsolatos k\u00f3dbeli hib\u00e1b\u00f3l ered, amely akkor l\u00e9p fel, amikor a shim \u00e1ltal el\u00e9rni k\u00edv\u00e1nt HTTP szerver hib\u00e1s v\u00e1laszokat ad vissza. A Shim HTTPBoot m\u00f3dja 2016 \u00f3ta el\u00e9rhet\u0151, \u00e9s lehet\u0151v\u00e9 teszi a h\u00e1l\u00f3zaton t\u00f6rt\u00e9n\u0151 bootol\u00e1st, HTTP protokoll seg\u00edts\u00e9g\u00e9vel, amely a k\u00f6vetkez\u0151 l\u00e9p\u00e9sben egy bet\u00f6lt\u0151t h\u00edv meg. A Shim HTTP-n kereszt\u00fcl bet\u00f6lt\u00f6tt f\u00e1jlok eset\u00e9n puffert alak\u00edt ki az \u00e1tvett adatok sz\u00e1m\u00e1ra, figyelembe v\u00e9ve nem az adatok t\u00e9nyleges m\u00e9ret\u00e9t, hanem a HTTP fejl\u00e9c\u00e9ben megadott 'Content-Length' m\u00e9retet. Ennek megfelel\u0151en, ha a Content-Length fejl\u00e9cben kisebb \u00e9rt\u00e9ket adunk vissza, lehet\u0151s\u00e9g ny\u00edlik a k\u00e9r\u00e9s v\u00e9g\u00e9nek a pufferen k\u00edv\u00fcli mem\u00f3ri\u00e1ba \u00edr\u00e1s\u00e1ra. <\/p>\n
Shim is digitally signed by Microsoft and verifies GRUB2 with its own certificate, allowing distribution developers to avoid signing every kernel and GRUB update with Microsoft. The vulnerability in Shim enables an intrusion into the trust chain during Secure Boot and provides full control over the subsequent boot process, for example, to boot another OS, modify operating system components, and bypass Lockdown protection. <\/p>\n
The vulnerability has been fixed in Shim version 15.8, but to fully block the attack via Shim, the new version must be signed by Microsoft and integrated into the distributions. The status of vulnerability remediation in distributions can be evaluated on these pages: Debian, Ubuntu, SUSE, RHEL, Fedora. The issue is that without revoking the signature of the old version, the fix is meaningless, as an attacker could use a boot medium with a vulnerable Shim release to compromise UEFI Secure Boot. However, revoking the signature would prevent verified booting of distributions that continue to use the old version of Shim. <\/p>\n
A sebezhet\u0151s\u00e9g visszavon\u00e1sa n\u00e9lk\u00fcli blokkol\u00e1s\u00e1hoz a disztrib\u00faci\u00f3k haszn\u00e1lhatj\u00e1k az SBAT mechanizmust (UEFI Secure Boot Advanced Targeting), amelynek t\u00e1mogat\u00e1sa a GRUB2-re, shim-re \u00e9s fwupd-re a legt\u00f6bb n\u00e9pszer\u0171 Linux disztrib\u00faci\u00f3ban megval\u00f3sult. Az SBAT-ot a Microsoft egy\u00fcttm\u0171k\u00f6d\u00e9s\u00e9vel fejlesztett\u00e9k ki, \u00e9s plusz metaadat\u00e1k hozz\u00e1ad\u00e1s\u00e1t jelenti az UEFI komponensek v\u00e9grehajthat\u00f3 f\u00e1jljaihoz, amelyek tartalmazz\u00e1k a gy\u00e1rt\u00f3r\u00f3l, term\u00e9kr\u0151l, komponensr\u0151l \u00e9s verzi\u00f3r\u00f3l sz\u00f3l\u00f3 inform\u00e1ci\u00f3kat. Ezek a metaadatok digit\u00e1lis al\u00e1\u00edr\u00e1ssal hiteles\u00edtettek, \u00e9s k\u00fcl\u00f6n-k\u00fcl\u00f6n is szerepelhetnek az UEFI Secure Boot enged\u00e9lyezett vagy tilthat\u00f3 komponenseinek list\u00e1j\u00e1n. <\/p>\n
A SBAT lehet\u0151v\u00e9 teszi a digit\u00e1lis al\u00e1\u00edr\u00e1s haszn\u00e1lat\u00e1nak blokkol\u00e1s\u00e1t a komponensek k\u00fcl\u00f6nb\u00f6z\u0151 verzi\u00f3sz\u00e1maihoz an\u00e9lk\u00fcl, hogy sz\u00fcks\u00e9g lenne a Secure Boot kulcsainak visszavon\u00e1s\u00e1ra. A sebezhet\u0151s\u00e9gek SBAT \u00e1ltali blokkol\u00e1sa nem ig\u00e9nyli az UEFI (dbx) visszavont tan\u00fas\u00edtv\u00e1nyainak list\u00e1j\u00e1nak haszn\u00e1lat\u00e1t, hanem a bels\u0151 kulcs felv\u00e1lt\u00e1s\u00e1nak szintj\u00e9n t\u00f6rt\u00e9nik az al\u00e1\u00edr\u00e1sok form\u00e1l\u00e1s\u00e1hoz \u00e9s a GRUB2, shim \u00e9s egy\u00e9b biztos\u00edtott disztrib\u00faci\u00f3k \u00e1ltal biztos\u00edtott ind\u00edt\u00f3 artefaktumok friss\u00edt\u00e9s\u00e9hez. <\/p>\n
A vizsg\u00e1lt sebezhet\u0151s\u00e9gen k\u00edv\u00fcl a Shim 15.8-ban sz\u00e1mos, helyileg kihaszn\u00e1lhat\u00f3, kev\u00e9sb\u00e9 vesz\u00e9lyes probl\u00e9ma is jav\u00edt\u00e1sra ker\u00fclt: <\/p>\n