{"id":110421,"date":"2023-10-04T09:10:18","date_gmt":"2023-10-04T07:10:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot"},"modified":"2023-10-04T09:10:18","modified_gmt":"2023-10-04T07:10:18","slug":"uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","title":{"rendered":"Vulnerabilidade no driver NTFS do GRUB2, permitindo a execu\u00e7\u00e3o de c\u00f3digo e a contorna\u00e7\u00e3o do UEFI Secure Boot","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Uma vulnerabilidade foi identificada no driver que opera com o sistema de arquivos NTFS no carregador GRUB2 (CVE-2023-4692), permitindo a execu\u00e7\u00e3o de c\u00f3digo malicioso no n\u00edvel do carregador ao acessar uma imagem de sistema de arquivos especialmente formatada. Essa vulnerabilidade pode ser utilizada para contornar o mecanismo de verifica\u00e7\u00e3o de inicializa\u00e7\u00e3o UEFI Secure Boot. <\/p>\n

A vulnerabilidade \u00e9 causada por um erro no c\u00f3digo de an\u00e1lise do atributo NTFS «$ATTRIBUTE_LIST» (grub-core\/fs\/ntfs.c), que pode ser explorado para gravar informa\u00e7\u00f5es controladas pelo usu\u00e1rio em uma \u00e1rea de mem\u00f3ria al\u00e9m do buffer reservado. O processamento de uma imagem NTFS especialmente formatada resulta em um estouro de buffer que reescreve parte da mem\u00f3ria do GRUB e, sob certas condi\u00e7\u00f5es, danifica a \u00e1rea de mem\u00f3ria do firmware UEFI, potencialmente permitindo a execu\u00e7\u00e3o de c\u00f3digo no n\u00edvel do carregador de inicializa\u00e7\u00e3o ou firmware. <\/p>\n

Al\u00e9m disso, foi identificada outra vulnerabilidade no driver NTFS do GRUB2 (CVE-2023-4693), que permite ler o conte\u00fado de uma \u00e1rea de mem\u00f3ria arbitr\u00e1ria ao analisar o atributo «$DATA» em uma imagem NTFS especialmente formatada. Entre outras coisas, a vulnerabilidade permite a extra\u00e7\u00e3o de dados confidenciais armazenados em cache na mem\u00f3ria ou a determina\u00e7\u00e3o dos valores das vari\u00e1veis EFI. <\/p>\n

Os problemas foram corrigidos apenas na forma de patches. O status da corre\u00e7\u00e3o das vulnerabilidades nas distribui\u00e7\u00f5es pode ser avaliado nas seguintes p\u00e1ginas: Debian, Ubuntu, SUSE, RHEL, Fedora. Para resolver os problemas no GRUB2, n\u00e3o \u00e9 suficiente apenas atualizar o pacote; tamb\u00e9m \u00e9 necess\u00e1rio gerar novas assinaturas digitais internas e atualizar instaladores, carregadores, pacotes do kernel, firmware fwupd e a camada shim. <\/p>\n

Na maioria das distribui\u00e7\u00f5es Linux, para a inicializa\u00e7\u00e3o verificada no modo UEFI Secure Boot, \u00e9 usada uma pequena camada shim, assinada digitalmente pela Microsoft. Essa camada verifica o GRUB2 com seu pr\u00f3prio certificado, permitindo que os desenvolvedores das distribui\u00e7\u00f5es n\u00e3o precisem assinar cada atualiza\u00e7\u00e3o do kernel e do GRUB pela Microsoft. Vulnerabilidades no GRUB2 permitem a execu\u00e7\u00e3o de c\u00f3digo ap\u00f3s a verifica\u00e7\u00e3o bem-sucedida do shim, mas antes da inicializa\u00e7\u00e3o do sistema operacional, infiltrando-se na cadeia de confian\u00e7a com o modo Secure Boot ativo e obtendo controle total sobre o processo de inicializa\u00e7\u00e3o, por exemplo, para inicializar outro SO, modificar componentes do sistema operacional e contornar a prote\u00e7\u00e3o Lockdown. <\/p>\n

Para bloquear a vulnerabilidade sem revogar a assinatura digital, as distribui\u00e7\u00f5es podem usar o mecanismo SBAT (UEFI Secure Boot Advanced Targeting), cujo suporte \u00e9 implementado para GRUB2, shim e fwupd na maioria das distribui\u00e7\u00f5es populares do Linux. O SBAT foi desenvolvido em conjunto com a Microsoft e implica a adi\u00e7\u00e3o de metadados adicionais nos arquivos execut\u00e1veis dos componentes UEFI, que incluem informa\u00e7\u00f5es sobre o fabricante, produto, componente e vers\u00e3o. Esses metadados s\u00e3o assinados digitalmente e podem ser inclu\u00eddos separadamente nas listas de componentes permitidos ou bloqueados para o UEFI Secure Boot. <\/p>\n

O SBAT permite bloquear o uso de assinatura digital para vers\u00f5es espec\u00edficas de componentes sem a necessidade de revogar chaves para o Secure Boot. O bloqueio de vulnerabilidades atrav\u00e9s do SBAT n\u00e3o requer o uso da lista de certificados revogados UEFI (dbx), mas \u00e9 realizado no n\u00edvel de substitui\u00e7\u00e3o da chave interna para a forma\u00e7\u00e3o de assinaturas e atualiza\u00e7\u00e3o do GRUB2, shim e outros artefatos de inicializa\u00e7\u00e3o fornecidos pelos distribuidores. Antes da implementa\u00e7\u00e3o do SBAT, atualizar a lista de certificados revogados (dbx, Lista de Revoga\u00e7\u00e3o UEFI) era uma condi\u00e7\u00e3o obrigat\u00f3ria para um bloqueio completo da vulnerabilidade, uma vez que um atacante, independentemente do sistema operacional utilizado, poderia comprometer o UEFI Secure Boot utilizando um carregador de inicializa\u00e7\u00e3o.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 NTFS \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-4692), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u043e\u0431\u0440\u0430\u0437\u0443 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043a\u043e\u0434\u0435 \u0440\u0430\u0437\u0431\u043e\u0440\u0430 NTFS-\u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0430 «$ATTRIBUTE_LIST» (grub-core\/fs\/ntfs.c), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110421","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilidade no driver NTFS do GRUB2 que permite executar c\u00f3digo e contornar o UEFI Secure Boot | ProHoster","description":"Uma vulnerabilidade (CVE-2023-4692) foi identificada no driver que permite o funcionamento com o sistema de arquivos NTFS no carregador GRUB2, permitindo a execu\u00e7\u00e3o de c\u00f3digo personalizado no n\u00edvel do carregador ao acessar algo espec\u00edfico.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 NTFS-\u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435 \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 GRUB2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 UEFI Secure Boot | ProHoster","og:description":"\u0412 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 NTFS \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-4692), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-04T07:10:18+00:00","article:modified_time":"2023-10-04T07:10:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/110421","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=110421"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/110421\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=110421"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=110421"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=110421"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}