{"id":105601,"date":"2022-11-16T21:37:02","date_gmt":"2022-11-16T19:37:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dve-uyazvimosti-v-grub2-pozvolyayushhie-obojti-zashhitu-uefi-secure-boot"},"modified":"2022-11-16T21:37:02","modified_gmt":"2022-11-16T19:37:02","slug":"dve-uyazvimosti-v-grub2-pozvolyayushhie-obojti-zashhitu-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/dve-uyazvimosti-v-grub2-pozvolyayushhie-obojti-zashhitu-uefi-secure-boot","title":{"rendered":"Dou\u0103 vulnerabilit\u0103\u021bi \u00een GRUB2 care permit ocolirea protec\u021biei UEFI Secure Boot","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>S-au dezv\u0103luit informa\u021bii despre dou\u0103 vulnerabilit\u0103\u021bi \u00een bootloaderul GRUB2, care pot duce la executarea de cod atunci c\u00e2nd se folosesc fonturi special concepute \u0219i la procesarea anumitor secven\u021be Unicode. Vulnerabilit\u0103\u021bile pot fi utilizate pentru a ocoli mecanismul de validare a \u00eenc\u0103rc\u0103rii UEFI Secure Boot.        <\/p>\n<p>Vulnerabilit\u0103\u021bile identificate:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2022-2601 \u2014 o supra\u00eenc\u0103rcare a buffer-ului \u00een func\u021bia grub_font_construct_glyph() atunci c\u00e2nd se proceseaz\u0103 fonturi formatate \u00een mod special \u00een formatul pf2, care apare dintr-o calculare incorect\u0103 a parametrului max_glyph_size \u0219i alocarea unei zone de memorie vizibil mai mici dec\u00e2t este necesar\u0103 pentru a gazdui glifele.\n<li class=\"l\"> CVE-2022-3775 \u2014 scrierea \u00een afara zonei de memorie alocate atunci c\u00e2nd se red\u0103 anumite secven\u021be Unicode cu un font formatat special. Problema este prezent\u0103 \u00een codul de procesare a fonturilor \u0219i este cauzat\u0103 de absen\u021ba unor verific\u0103ri adecvate \u00eentre l\u0103\u021bimea \u0219i \u00een\u0103l\u021bimea glifei \u0219i dimensiunea h\u0103r\u021bii de bi\u021bi disponibile. Atacatorul poate manipula intrarea astfel \u00eenc\u00e2t s\u0103 provoace scrierea v\u00e2rfului de date dincolo de buffer-ul alocat. Se observ\u0103 c\u0103, \u00een ciuda complexit\u0103\u021bii exploat\u0103rii vulnerabilit\u0103\u021bii, atingerea execut\u0103rii codului nu este exclus\u0103.                <\/ul>\n<p> O corectare a fost publicat\u0103 sub form\u0103 de patch. Stadiul solu\u021bion\u0103rii vulnerabilit\u0103\u021bilor \u00een distribu\u021bii poate fi evaluat pe aceste pagini: Ubuntu, SUSE, RHEL, Fedora, Debian. Pentru a rezolva problemele din GRUB2 nu este suficient s\u0103 actualiza\u021bi pur \u0219i simplu pachetul, va fi necesar s\u0103 crea\u021bi \u0219i noi semn\u0103turi digitale interne \u0219i s\u0103 actualiza\u021bi instalatoarele, bootloader-ele, pachetele de kernel, firmware-urile fwupd \u0219i stratul shim.       <\/p>\n<p>\u00cen majoritatea distribu\u021biilor Linux, pentru bootarea verificat\u0103 \u00een modul UEFI Secure Boot se folose\u0219te un mic strat shim, semnat digital de Microsoft. Acest strat verific\u0103 GRUB2 cu propriul certificat, permi\u021b\u00e2nd distribuitorilor s\u0103 nu semneze fiecare actualizare de kernel \u0219i GRUB \u00een Microsoft. Vulnerabilit\u0103\u021bile din GRUB2 permit executarea codului propriu \u00een etapa de dup\u0103 verificarea reu\u0219it\u0103 a shim, dar \u00eenainte de \u00eenc\u0103rcarea sistemului de operare, intervenind \u00een lan\u021bul de \u00eencredere \u00een modul Secure Boot activ \u0219i ob\u021bin\u00e2nd control total asupra procesului de bootare ulterioar\u0103, inclusiv pentru bootarea unei alte OS, modificarea componentelor sistemului de operare \u0219i ocolirea protec\u021biei Lockdown.     <\/p>\n<p>Pentru blocarea vulnerabilit\u0103\u021bii f\u0103r\u0103 revocarea semn\u0103turii digitale, distribu\u021biile pot utiliza mecanismul SBAT (UEFI Secure Boot Advanced Targeting), pentru care suportul este implementat \u00een GRUB2, shim \u0219i fwupd \u00een cele mai populare distribu\u021bii Linux. SBAT a fost dezvoltat \u00een colaborare cu Microsoft \u0219i prevede ad\u0103ugarea de metadate suplimentare \u00een fi\u0219ierele executabile ale componentelor UEFI, care includ informa\u021bii despre produc\u0103tor, produs, component\u0103 \u0219i versiune. Aceste metadate sunt semnate digital \u0219i pot fi incluse separat \u00een listele de componente permise sau interzise pentru UEFI Secure Boot.      <\/p>\n<p>SBAT permite blocarea utiliz\u0103rii semn\u0103turii digitale pentru anumite versiuni ale componentelor f\u0103r\u0103 a fi necesar\u0103 revocarea cheilor pentru Secure Boot. Blocarea vulnerabilit\u0103\u021bilor prin SBAT nu necesit\u0103 utilizarea listei de certificate revocate UEFI (dbx), \u0219i se realizeaz\u0103 la nivelul \u00eenlocuirii cheii interne pentru formarea semn\u0103turilor \u0219i actualizarea GRUB2, shim \u0219i altor artefacte de boot livrate de distribu\u021bii. P\u00e2n\u0103 la implementarea SBAT, actualizarea listei de certificate revocate (dbx, Lista de Revocare UEFI) era o condi\u021bie obligatorie pentru blocarea complet\u0103 a vulnerabilit\u0103\u021bii, deoarece atacatorul, indiferent de sistemul de operare folosit, putea compromite UEFI Secure Boot utiliz\u00e2nd un mediu de boot cu o versiune veche vulnerabil\u0103 a GRUB2, certificat cu o semn\u0103tur\u0103 digital\u0103.<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=58130\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0448\u0440\u0438\u0444\u0442\u043e\u0432 \u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 Unicode-\u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0435\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot. \u0412\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2022-2601 &#8212; \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 grub_font_construct_glyph() \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0448\u0440\u0438\u0444\u0442\u043e\u0432 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 pf2, \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0449\u0435\u0435 \u0438\u0437-\u0437\u0430 \u043d\u0435\u0432\u0435\u0440\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u0447\u0451\u0442\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105601","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0448\u0440\u0438\u0444\u0442\u043e\u0432 \u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 Unicode-\u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0435\u0439.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/dve-uyazvimosti-v-grub2-pozvolyayushhie-obojti-zashhitu-uefi-secure-boot\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0414\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 GRUB2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 UEFI Secure Boot | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0448\u0440\u0438\u0444\u0442\u043e\u0432 \u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 Unicode-\u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0435\u0439.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/dve-uyazvimosti-v-grub2-pozvolyayushhie-obojti-zashhitu-uefi-secure-boot\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-11-16T19:37:02+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-11-16T19:37:02+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dou\u0103 vulnerabilit\u0103\u021bi \u00een GRUB2, care permit ocolirea protec\u021biei UEFI Secure Boot | ProHoster","description":"Informa\u021biile despre dou\u0103 vulnerabilit\u0103\u021bi \u00een bootloader-ul GRUB2 au fost dezv\u0103luite, care pot duce la executarea de cod prin utilizarea de fonturi special concepute \u0219i prin procesarea unor secven\u021be Unicode specifice.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/dve-uyazvimosti-v-grub2-pozvolyayushhie-obojti-zashhitu-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 GRUB2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 UEFI Secure Boot | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0448\u0440\u0438\u0444\u0442\u043e\u0432 \u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 Unicode-\u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0435\u0439.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/dve-uyazvimosti-v-grub2-pozvolyayushhie-obojti-zashhitu-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-11-16T19:37:02+00:00","article:modified_time":"2022-11-16T19:37:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/105601","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=105601"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/105601\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=105601"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=105601"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=105601"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}