{"id":105601,"date":"2022-11-16T21:37:02","date_gmt":"2022-11-16T19:37:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dve-uyazvimosti-v-grub2-pozvolyayushhie-obojti-zashhitu-uefi-secure-boot"},"modified":"2022-11-16T21:37:02","modified_gmt":"2022-11-16T19:37:02","slug":"dve-uyazvimosti-v-grub2-pozvolyayushhie-obojti-zashhitu-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/dve-uyazvimosti-v-grub2-pozvolyayushhie-obojti-zashhitu-uefi-secure-boot","title":{"rendered":"Duas vulnerabilidades no GRUB2 que permitem contornar a prote\u00e7\u00e3o do UEFI Secure Boot","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Foram reveladas informa\u00e7\u00f5es sobre duas vulnerabilidades no carregador GRUB2, que podem permitir a execu\u00e7\u00e3o de c\u00f3digo ao utilizar fontes especialmente formatadas e ao processar determinadas sequ\u00eancias Unicode. As vulnerabilidades podem ser utilizadas para contornar o mecanismo de verifica\u00e7\u00e3o de inicializa\u00e7\u00e3o UEFI Secure Boot.        <\/p>\n<p>Vulnerabilidades identificadas:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2022-2601 \u2014 estouro de buffer na fun\u00e7\u00e3o grub_font_construct_glyph() ao processar fontes formatadas em pf2, resultante de um c\u00e1lculo incorreto do par\u00e2metro max_glyph_size e da aloca\u00e7\u00e3o de uma \u00e1rea de mem\u00f3ria deliberadamente menor do que o necess\u00e1rio para acomodar os glifos.\n<li class=\"l\"> CVE-2022-3775 \u2014 grava\u00e7\u00e3o al\u00e9m da \u00e1rea de mem\u00f3ria alocada ao renderizar algumas sequ\u00eancias Unicode com uma fonte especialmente formatada. O problema est\u00e1 presente no c\u00f3digo de processamento de fontes e \u00e9 causado pela falta de verifica\u00e7\u00f5es adequadas sobre a largura e altura do glifo em rela\u00e7\u00e3o ao tamanho do bitmap existente. Um atacante pode fornecer uma entrada de forma a causar a grava\u00e7\u00e3o de dados no limite do buffer alocado. Observa-se que, apesar da complexidade de explorar a vulnerabilidade, n\u00e3o se exclui a possibilidade de execu\u00e7\u00e3o de c\u00f3digo.                <\/ul>\n<p> Uma corre\u00e7\u00e3o foi publicada na forma de um patch. O status da corre\u00e7\u00e3o das vulnerabilidades nas distribui\u00e7\u00f5es pode ser avaliado nas seguintes p\u00e1ginas: Ubuntu, SUSE, RHEL, Fedora, Debian. Para corrigir problemas no GRUB2, n\u00e3o \u00e9 suficiente apenas atualizar o pacote, tamb\u00e9m ser\u00e1 necess\u00e1rio gerar novas assinaturas digitais internas e atualizar instaladores, carregadores, pacotes com o kernel, firmwares fwupd e a camada shim.       <\/p>\n<p>Na maioria das distribui\u00e7\u00f5es Linux, para a inicializa\u00e7\u00e3o verificada em modo UEFI Secure Boot, \u00e9 utilizado um pequeno m\u00f3dulo shim, assinado digitalmente pela Microsoft. Este m\u00f3dulo verifica o GRUB2 com seu pr\u00f3prio certificado, permitindo que os desenvolvedores de distribui\u00e7\u00f5es n\u00e3o precisem assinar cada atualiza\u00e7\u00e3o do kernel e do GRUB com a Microsoft. As vulnerabilidades no GRUB2 permitem a execu\u00e7\u00e3o de c\u00f3digo pr\u00f3prio ap\u00f3s a verifica\u00e7\u00e3o bem-sucedida do shim, mas antes do carregamento do sistema operacional, inserindo-se na cadeia de confian\u00e7a com o modo Secure Boot ativo e assumindo controle total sobre o processo de inicializa\u00e7\u00e3o subsequente, incluindo a inicializa\u00e7\u00e3o de outro sistema operacional, modifica\u00e7\u00e3o de componentes do sistema operacional e contorno da prote\u00e7\u00e3o Lockdown.     <\/p>\n<p>Para bloquear a vulnerabilidade sem revogar a assinatura digital, as distribui\u00e7\u00f5es podem usar o mecanismo SBAT (UEFI Secure Boot Advanced Targeting), cujo suporte \u00e9 implementado para GRUB2, shim e fwupd na maioria das distribui\u00e7\u00f5es populares do Linux. O SBAT foi desenvolvido em conjunto com a Microsoft e implica a adi\u00e7\u00e3o de metadados adicionais nos arquivos execut\u00e1veis dos componentes UEFI, que incluem informa\u00e7\u00f5es sobre o fabricante, produto, componente e vers\u00e3o. Esses metadados s\u00e3o assinados digitalmente e podem ser inclu\u00eddos separadamente nas listas de componentes permitidos ou bloqueados para o UEFI Secure Boot.      <\/p>\n<p>O SBAT permite bloquear o uso de assinaturas digitais para vers\u00f5es espec\u00edficas de componentes sem a necessidade de revogar chaves para o Secure Boot. O bloqueio de vulnerabilidades via SBAT n\u00e3o requer o uso da lista de certificados revogados UEFI (dbx), sendo realizado no n\u00edvel de substitui\u00e7\u00e3o de chaves internas para a forma\u00e7\u00e3o de assinaturas e atualiza\u00e7\u00e3o do GRUB2, shim e outros artefatos de inicializa\u00e7\u00e3o fornecidos pelas distribui\u00e7\u00f5es. Antes da implementa\u00e7\u00e3o do SBAT, a atualiza\u00e7\u00e3o da lista de certificados revogados (dbx, UEFI Revocation List) era uma condi\u00e7\u00e3o obrigat\u00f3ria para o bloqueio total da vulnerabilidade, pois um atacante, independentemente do sistema operacional utilizado, podia comprometer o UEFI Secure Boot usando um meio de inicializa\u00e7\u00e3o com uma vers\u00e3o antiga vulner\u00e1vel do GRUB2, assinada digitalmente.<br \/>\n<br \/>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=58130\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0448\u0440\u0438\u0444\u0442\u043e\u0432 \u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 Unicode-\u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0435\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot. \u0412\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2022-2601 &#8212; \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 grub_font_construct_glyph() \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0448\u0440\u0438\u0444\u0442\u043e\u0432 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 pf2, \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0449\u0435\u0435 \u0438\u0437-\u0437\u0430 \u043d\u0435\u0432\u0435\u0440\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u0447\u0451\u0442\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105601","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0448\u0440\u0438\u0444\u0442\u043e\u0432 \u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 Unicode-\u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0435\u0439.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pt\/blog\/news\/dve-uyazvimosti-v-grub2-pozvolyayushhie-obojti-zashhitu-uefi-secure-boot\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"pt_PT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0414\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 GRUB2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 UEFI Secure Boot | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0448\u0440\u0438\u0444\u0442\u043e\u0432 \u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 Unicode-\u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0435\u0439.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pt\/blog\/news\/dve-uyazvimosti-v-grub2-pozvolyayushhie-obojti-zashhitu-uefi-secure-boot\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-11-16T19:37:02+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-11-16T19:37:02+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Duas vulnerabilidades no GRUB2 que permitem contornar a prote\u00e7\u00e3o UEFI Secure Boot | ProHoster","description":"Foram reveladas informa\u00e7\u00f5es sobre duas vulnerabilidades no carregador GRUB2, que podem permitir a execu\u00e7\u00e3o de c\u00f3digo ao utilizar fontes especialmente formatadas e ao processar determinadas sequ\u00eancias Unicode.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/dve-uyazvimosti-v-grub2-pozvolyayushhie-obojti-zashhitu-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 GRUB2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 UEFI Secure Boot | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0448\u0440\u0438\u0444\u0442\u043e\u0432 \u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 Unicode-\u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0435\u0439.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/dve-uyazvimosti-v-grub2-pozvolyayushhie-obojti-zashhitu-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-11-16T19:37:02+00:00","article:modified_time":"2022-11-16T19:37:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/105601","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=105601"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/105601\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=105601"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=105601"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=105601"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}