{"id":110421,"date":"2023-10-04T09:10:18","date_gmt":"2023-10-04T07:10:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot"},"modified":"2023-10-04T09:10:18","modified_gmt":"2023-10-04T07:10:18","slug":"uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","title":{"rendered":"Vulnerabilitate \u00een driverul NTFS din GRUB2, care permite executarea codului \u0219i ocolirea UEFI Secure Boot","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen driverul care asigur\u0103 func\u021bionarea sistemului de fi\u0219iere NTFS \u00een bootloader-ul GRUB2 a fost identificat\u0103 o vulnerabilitate (CVE-2023-4692), care permite executarea de cod personalizat la nivelul bootloader-ului prin accesarea unei imagini de sistem de fi\u0219iere special formate. Aceast\u0103 vulnerabilitate poate fi folosit\u0103 pentru a ocoli mecanismul de verificare a \u00eenc\u0103rc\u0103rii UEFI Secure Boot. <\/p>\n

Vulnerabilitatea este cauzat\u0103 de o eroare \u00een codul de analiz\u0103 a atributului NTFS «$ATTRIBUTE_LIST» (grub-core\/fs\/ntfs.c), care poate fi utilizat\u0103 pentru a scrie informa\u021bii controlate de utilizator \u00een zona de memorie din afara buffer-ului alocat. Atunci c\u00e2nd este procesat\u0103 o imagine NTFS formatat\u0103 special, dep\u0103\u0219irea buffer-ului duce la rescrierea unei p\u0103r\u021bi din memoria GRUB \u0219i, \u00een anumite condi\u021bii, la deteriorarea zonei de memorie a firmware-ului UEFI, ceea ce permite, poten\u021bial, executarea codului s\u0103u la nivelul bootloader-ului sau firmware-ului. <\/p>\n

De asemenea, \u00een driverul NTFS din GRUB2 a fost identificat\u0103 o alt\u0103 vulnerabilitate (CVE-2023-4693) care permite citirea con\u021binutului unei zone arbitrare de memorie \u00een timpul analizei atributului «$DATA» dintr-o imagine NTFS formatat\u0103 special. Printre altele, vulnerabilitatea permite extragerea datelor confiden\u021biale, stocate \u00een memorie, sau determinarea valorilor variabilelor EFI. <\/p>\n

Problemele au fost remediate p\u00e2n\u0103 acum doar sub form\u0103 de patch-uri. Starea remedierii vulnerabilit\u0103\u021bilor \u00een distribu\u021biile Linux poate fi evaluat\u0103 pe aceste pagini: Debian, Ubuntu, SUSE, RHEL, Fedora. Pentru a remedia problemele \u00een GRUB2 nu este suficient s\u0103 actualizezi doar pachetul, este necesar s\u0103 formezi \u0219i noi semn\u0103turi digitale interne \u0219i s\u0103 actualizezi instalatoarele, bootloader-ele, pachetele cu kernel, firmware-urile fwupd \u0219i stratul shim. <\/p>\n

\u00cen majoritatea distribu\u021biilor Linux, pentru verificarea \u00eenc\u0103rc\u0103rii \u00een modul UEFI Secure Boot se folose\u0219te un strat mic numit shim, certificat prin semn\u0103tura digital\u0103 a Microsoft. Acest strat verific\u0103 GRUB2 cu propriul certificat, ceea ce permite dezvoltatorilor de distribu\u021bii s\u0103 nu certifice fiecare actualizare a kernel-ului \u0219i GRUB la Microsoft. Vulnerabilit\u0103\u021bile din GRUB2 permit executarea de cod personalizat dup\u0103 verificarea cu succes a shim-ului, dar \u00eenainte de \u00eenc\u0103rcarea sistemului de operare, infiltr\u00e2ndu-se \u00een lan\u021bul de \u00eencredere \u00een modul Secure Boot activ \u0219i ob\u021bin\u00e2nd control total asupra procesului de \u00eenc\u0103rcare ulterioare, de exemplu, pentru a \u00eenc\u0103rca un alt sistem de operare, a modifica componentele sistemului de operare \u0219i a ocoli protec\u021bia Lockdown. <\/p>\n

Pentru blocarea vulnerabilit\u0103\u021bii f\u0103r\u0103 revocarea semn\u0103turii digitale, distribu\u021biile pot utiliza mecanismul SBAT (UEFI Secure Boot Advanced Targeting), pentru care suportul este implementat \u00een GRUB2, shim \u0219i fwupd \u00een cele mai populare distribu\u021bii Linux. SBAT a fost dezvoltat \u00een colaborare cu Microsoft \u0219i prevede ad\u0103ugarea de metadate suplimentare \u00een fi\u0219ierele executabile ale componentelor UEFI, care includ informa\u021bii despre produc\u0103tor, produs, component\u0103 \u0219i versiune. Aceste metadate sunt semnate digital \u0219i pot fi incluse separat \u00een listele de componente permise sau interzise pentru UEFI Secure Boot. <\/p>\n

SBAT permite blocarea utiliz\u0103rii semn\u0103turii digitale pentru anumite numere de versiune ale componentelor f\u0103r\u0103 a fi necesar\u0103 revocarea cheilor pentru Secure Boot. Blocarea vulnerabilit\u0103\u021bilor prin SBAT nu necesit\u0103 utilizarea listei de certificate revocate UEFI (dbx), ci se face la nivelul \u00eenlocuirii cheii interne pentru generarea semn\u0103turilor \u0219i actualizarea GRUB2, shim \u0219i altor artefacte de boot furnizate de distribu\u021bii. P\u00e2n\u0103 la implementarea SBAT, actualizarea listei de certificate revocate (dbx, UEFI Revocation List) era o condi\u021bie obligatorie pentru blocarea complet\u0103 a vulnerabilit\u0103\u021bii, deoarece un atacator, indiferent de sistemul de operare utilizat, putea compromite UEFI Secure Boot folosind bootloader.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 NTFS \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-4692), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u043e\u0431\u0440\u0430\u0437\u0443 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043a\u043e\u0434\u0435 \u0440\u0430\u0437\u0431\u043e\u0440\u0430 NTFS-\u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0430 «$ATTRIBUTE_LIST» (grub-core\/fs\/ntfs.c), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110421","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een driverul NTFS din GRUB2, care permite executarea codului \u0219i ocolirea UEFI Secure Boot | ProHoster","description":"\u00cen driverul care asigur\u0103 func\u021bionarea cu sistemul de fi\u0219iere NTFS \u00een bootloaderul GRUB2, a fost identificat\u0103 o vulnerabilitate (CVE-2023-4692) care permite executarea codului propriu la nivelul bootloader-ului prin accesarea unui anumit set de condi\u021bii.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 NTFS-\u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435 \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 GRUB2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 UEFI Secure Boot | ProHoster","og:description":"\u0412 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 NTFS \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-4692), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-ntfs-drajvere-iz-sostava-grub2-pozvolyayushhaya-vypolnit-kod-i-obojti-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-04T07:10:18+00:00","article:modified_time":"2023-10-04T07:10:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/110421","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=110421"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/110421\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=110421"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=110421"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=110421"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}