Edobere adịghị ike 2 na GRUB7 bootloader nke na-enye gị ohere ịgafe usoro UEFI Secure Boot ma mee koodu akwadoghị, dịka ọmụmaatụ, webata malware na-agba ọsọ na bootloader ma ọ bụ kernel larịị. Na mgbakwunye, enwere otu adịghị ike na oyi akwa shim, nke na-enye gị ohere ịgafe UEFI Secure Boot. Akpọrọ ìgwè adịghị ike ahụ Boothole 3, yiri nsogbu ndị yiri nke ahụ achọpụtara na mbụ na bootloader.
Iji dozie nsogbu na GRUB2 na shim, nkesa ga-enwe ike iji usoro SBAT (UEFI Secure Boot Advanced Targeting), nke akwadoro maka GRUB2, shim na fwupd. Emepụtara SBAT na Microsoft jikọrọ aka wee tinye mgbakwunye metadata ọzọ na faịlụ arụ ọrụ nke akụrụngwa UEFI, nke gụnyere ozi gbasara onye nrụpụta, ngwaahịa, akụrụngwa na ụdị. Ejiri akara mbinye aka dijitalụ nweta metadata akọwapụtara ma enwere ike itinye ya iche na ndepụta nke ihe ekwenyere ma ọ bụ ihe amachibidoro maka UEFI Secure Boot.
Imirikiti nkesa Linux na-eji obere oyi akwa shim nke Microsoft bịanyere aka na dijitalụ maka ịgbanye agbagoro na ọnọdụ UEFI Secure Boot. Ihe oyi akwa a na-enyocha GRUB2 na asambodo nke ya, nke na-enye ohere ka ndị mmepe nkesa ghara inwe mmelite kernel na GRUB ọ bụla sitere na Microsoft. Ihe ọghọm dị na GRUB2 na-enye gị ohere imezu mmezu nke koodu gị na ogbo mgbe nkwenye shim ga-aga nke ọma, mana tupu ịwụnye sistemụ arụmọrụ, banye n'ime agbụ ntụkwasị obi mgbe ọnọdụ Secure Boot na-arụ ọrụ ma nweta njikwa zuru oke na usoro buut n'ihu, gụnyere. na-ebunye OS ọzọ, na-agbanwe sistemu akụrụngwa sistemu arụ ọrụ yana mgbochi mkpọchi mkpọchi.
Iji dozie nsogbu na bootloader, nkesa ga-emepụta mbinye aka dijitalụ ọhụrụ na imelite installers, bootloaders, kernel packages, fwupd firmware na shim Layer. Tupu iwebata SBAT, imelite ndepụta mwepu akwụkwọ (dbx, UEFI Ntughari Ndepụta) bụ ihe achọrọ maka igbochi adịghị ike kpamkpam, ebe ọ bụ na onye na-awakpo, n'agbanyeghị sistemụ arụmọrụ ejiri, nwere ike iji mgbasa ozi bootable nwere ụdị GRUB2 ochie adịghị ike, kwadoro site na mbinye aka dijitalụ, iji mebie UEFI Secure Boot .
Kama ịkagbu mbinye aka, SBAT na-enye gị ohere igbochi ojiji ya maka ọnụọgụ ụdị ngwa ọ bụla na-enweghị ịwepụ igodo maka Boot Secure. Mgbochi adịghị ike site na SBAT anaghị achọ iji ndepụta mwepu akwụkwọ UEFI (dbx), mana a na-eme ya n'ogo nke dochie igodo ime iji mepụta mbinye aka na melite GRUB2, shim na arịa akpụkpọ ụkwụ ndị ọzọ nke nkesa wetara. Ugbu a, agbakwunyela nkwado SBAT na nkesa Linux kachasị ewu ewu.
Achọpụtara adịghị ike:
- CVE-2021-3696, CVE-2021-3695 bụ ihe nkpuchi na-eju oke mgbe ị na-ahazi onyonyo PNG ahaziri nke ọma, nke enwere ike iji usoro iwu mebie koodu mwakpo wee gafere UEFI Secure Boot. A na-achọpụta na nsogbu ahụ siri ike iji mee ihe, ebe ọ bụ na ịmepụta ihe na-arụ ọrụ na-arụ ọrụ chọrọ iburu n'uche ọnụ ọgụgụ dị ukwuu nke ihe na ịnweta ozi gbasara nhazi ebe nchekwa.
- CVE-2021-3697 - Ihe nchekwa na-asọba na koodu nhazi onyonyo JPEG. Iji okwu a na-achọ ihe ọmụma nke nhazi ebe nchekwa na ọ dị ihe dịka otu ọkwa mgbagwoju anya dị ka okwu PNG (CVSS 7.5).
- CVE-2022-28733 - Integer njupụta na ọrụ grub_net_recv_ip4_packets() na-enye ohere emetụta rsm->total_len parameter site na izipu ngwugwu IP emepụtara pụrụ iche. Akara okwu a dị ka nke kachasị dị ize ndụ nke adịghị ike ndị ewepụtara (CVSS 8.1). Ọ bụrụ na ejiri nke ọma mee ihe, adịghị ike ahụ na-enye ohere ka edere data gafere oke nchekwa site na-ekenye obere ebe nchekwa ụma.
- CVE-2022-28734 - Ihe nchekwa otu-byte na-ejupụta mgbe a na-edozi isi ihe HTTP ewepụrụ. Esemokwu nwere ike ịkpata nrụrụ aka metadata GRUB2 (na-ede ihe na-adịghị mma obere oge ka ngwụcha nke nchekwa ahụ gasịrị) mgbe ị na-atụgharị arịrịọ HTTP emebere nke ọma.
- CVE-2022-28735 Esemokwu dị na shim_lock verifier na-enye ohere ibu faịlụ na-abụghị kernel. Enwere ike iji adịghị ike ahụ bulite modul kernel mbinye aka ma ọ bụ koodu akwadoghị na UEFI Secure Boot mode.
- CVE-2022-28736 ohere ebe nchekwa ewepụtaralarị na ọrụ grub_cmd_chainloader() site na nrụgharị nke iwu chainloader, nke ejiri bute sistemu arụ ọrụ nke GRUB2 anaghị akwado. Mgbugbu nwere ike bute ogbugbu koodu onye mwakpo ma ọ bụrụ na onye mwakpo ahụ nwere ike ikpebi oke ebe nchekwa na GRUB2.
- CVE-2022-28737 - Ihe nchekwa ihe na-ejupụta na oyi akwa shim na-eme na ọrụ aka_image () mgbe ị na-ebu ma na-eme ihe oyiyi EFI emebere.
isi: opennet.ru