{"id":113151,"date":"2024-01-26T18:50:27","date_gmt":"2024-01-26T16:50:27","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonnaya-uyazvimost-v-proslojke-shim-pozvolyayushhaya-obojti-uefi-secure-boot"},"modified":"2024-01-26T18:50:27","modified_gmt":"2024-01-26T16:50:27","slug":"udalyonnaya-uyazvimost-v-proslojke-shim-pozvolyayushhaya-obojti-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/udalyonnaya-uyazvimost-v-proslojke-shim-pozvolyayushhaya-obojti-uefi-secure-boot","title":{"rendered":"Vulnerabilitate la distan\u021b\u0103 \u00een stratul Shim, care permite ocolirea UEFI Secure Boot","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>\u00cen stratul Shim, folosit \u00een majoritatea distribu\u021biilor Linux pentru \u00eenc\u0103rcarea verificat\u0103 \u00een modul UEFI Secure Boot, a fost descoperit\u0103 o vulnerabilitate (CVE-2023-40547) care poate duce la executarea de cod de la distan\u021b\u0103 \u0219i la ocolirea mecanismului de \u00eenc\u0103rcare verificat\u0103 UEFI Secure Boot. Un atacator care controleaz\u0103 serverul HTTP la care Shim se conecteaz\u0103 poate returna un r\u0103spuns format special, ce duce la scrierea controlat\u0103 \u00een zona din afara buffer-ului, pentru a permite executarea codului \u00een etapa timpurie a \u00eenc\u0103rc\u0103rii.        <\/p>\n<p>Vulnerabilitatea este cauzat\u0103 de o eroare \u00een codul de \u00eenc\u0103rcare a fi\u0219ierelor prin HTTP, care se manifest\u0103 atunci c\u00e2nd se proceseaz\u0103 r\u0103spunsuri incorecte returnate de serverul HTTP la care se face apel din shim. Modul HTTPBoot \u00een Shim este sus\u021binut din 2016 \u0219i permite organizarea \u00eenc\u0103rc\u0103rii prin re\u021bea, utiliz\u00e2nd protocolul HTTP pentru a extrage fi\u0219ierul cu bootloader-ul invocat \u00een etapa urm\u0103toare. Shim, c\u00e2nd \u00eencarc\u0103 fi\u0219iere prin HTTP, aloc\u0103 un buffer pentru datele primite, av\u00e2nd \u00een vedere nu dimensiunea real\u0103 a datelor, ci dimensiunea specificat\u0103 \u00een header-ul HTTP \u201eContent-Length\u201d. Prin urmare, return\u00e2nd o valoare mai mic\u0103 \u00een header-ul Content-Length, se poate reu\u0219i s\u0103 se scrie coada cererii \u00een memorie \u00een afara buffer-ului.          <\/p>\n<p>Shim este semnat digital de Microsoft \u0219i verific\u0103 GRUB2 cu propriul certificat, ceea ce permite dezvoltatorilor de distribu\u021bii s\u0103 nu semneze fiecare actualizare a kernelului \u0219i GRUB la Microsoft. Vulnerabilitatea din Shim permite infiltrarea \u00een lan\u021bul de \u00eencredere \u00een modul Secure Boot activ \u0219i ob\u021binerea controlului total asupra procesului de \u00eenc\u0103rcare ulterior, de exemplu, pentru a \u00eenc\u0103rca un alt OS, pentru a modifica componentele sistemului de operare \u0219i pentru a ocoli protec\u021bia Lockdown.       <\/p>\n<p>Vulnerabilitatea a fost remediat\u0103 \u00een versiunea Shim 15.8, dar pentru a bloca complet atacurile prin Shim este necesar\u0103 semnarea unei noi versiuni de c\u0103tre Microsoft \u0219i implementarea acesteia \u00een distribu\u021bii. Statutul remedierii vulnerabilit\u0103\u021bii \u00een distribu\u021bii poate fi evaluat pe aceste pagini: Debian, Ubuntu, SUSE, RHEL, Fedora. Problema este c\u0103, f\u0103r\u0103 revocarea semn\u0103turii versiunii mai vechi, remedierea este inutil\u0103, deoarece atacatorul poate folosi un mediu de boot cu versiunea vulnerabil\u0103 Shim pentru a compromite UEFI Secure Boot. \u00cens\u0103 revocarea semn\u0103turii va duce la imposibilitatea \u00eenc\u0103rc\u0103rii verificate a distribu\u021biilor care continu\u0103 s\u0103 utilizeze versiunea veche de Shim.    <\/p>\n<p>Pentru blocarea vulnerabilit\u0103\u021bii f\u0103r\u0103 revocarea semn\u0103turii digitale, distribu\u021biile pot utiliza mecanismul SBAT (UEFI Secure Boot Advanced Targeting), pentru care suportul este implementat \u00een GRUB2, shim \u0219i fwupd \u00een cele mai populare distribu\u021bii Linux. SBAT a fost dezvoltat \u00een colaborare cu Microsoft \u0219i prevede ad\u0103ugarea de metadate suplimentare \u00een fi\u0219ierele executabile ale componentelor UEFI, care includ informa\u021bii despre produc\u0103tor, produs, component\u0103 \u0219i versiune. Aceste metadate sunt semnate digital \u0219i pot fi incluse separat \u00een listele de componente permise sau interzise pentru UEFI Secure Boot.      <\/p>\n<p>SBAT permite blocarea utiliz\u0103rii semn\u0103turii digitale pentru anumite versiuni ale componentelor f\u0103r\u0103 a fi nevoie de revocarea cheilor pentru Secure Boot. Blocarea vulnerabilit\u0103\u021bilor prin SBAT nu necesit\u0103 utilizarea listei cu certificate revocate UEFI (dbx), ci se realizeaz\u0103 la nivelul \u00eenlocuirii cheii interne pentru a crea semn\u0103turi \u0219i actualizarea GRUB2, shim \u0219i altor artefacte de boot livrate de distribu\u021bii.         <\/p>\n<p>Pe l\u00e2ng\u0103 vulnerabilitatea discutat\u0103, \u00een Shim 15.8 au fost remediate \u0219i c\u00e2teva probleme mai pu\u021bin periculoase, exploatate local:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2023-40548 \u2014 o dep\u0103\u0219ire a num\u0103rului \u00eentreg \u00een func\u021bia verify_sbat_section, care duce la dep\u0103\u0219irea buffer-ului pe sisteme de 32 de bi\u021bi.\n<li class=\"l\"> CVE-2023-40546 \u2014 citirea din zona de memorie \u00een afara buffer-ului \u00een timpul afi\u0219\u0103rii mesajelor de eroare prin func\u021bia LogError().\n<li class=\"l\"> CVE-2023-40549 \u2014 citirea din zona de memorie \u00een afara buffer-ului \u00een timpul prelucr\u0103rii unei fi\u0219iere PE realizat special \u00een func\u021bia verify_buffer_authenticode().\n<li class=\"l\"> CVE-2023-40550 \u2014 citirea din zona de memorie \u00een afara buffer-ului \u00een func\u021bia verify_buffer_sbat().\n<li class=\"l\"> CVE-2023-40551 \u2014 citirea din zona de memorie \u00een afara buffer-ului \u00een timpul analizei fi\u0219ierelor \u00een format MZ.    <\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60501\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0435 Shim, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0432 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 UEFI Secure Boot, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-40547), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0438 \u043e\u0431\u0445\u043e\u0434\u0443 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u044e\u0449\u0438\u0439 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440, \u043a \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043e\u0431\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f Shim, \u043c\u043e\u0436\u0435\u0442 \u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0439 \u043e\u0442\u0432\u0435\u0442, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0439 \u043a \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u044c \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0443 \u0431\u0443\u0444\u0435\u0440\u0430 \u0434\u043b\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113151","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0435 Shim, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0432 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 UEFI Secure Boot, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-40547), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/udalyonnaya-uyazvimost-v-proslojke-shim-pozvolyayushhaya-obojti-uefi-secure-boot\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0435 Shim, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 UEFI Secure Boot | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0435 Shim, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0432 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 UEFI Secure Boot, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-40547), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/udalyonnaya-uyazvimost-v-proslojke-shim-pozvolyayushhaya-obojti-uefi-secure-boot\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-01-26T16:50:27+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-01-26T16:50:27+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate la distan\u021b\u0103 \u00een stratul Shim, care permite ocolirea UEFI Secure Boot | ProHoster","description":"\u00cen stratul Shim, utilizat \u00een majoritatea distribu\u021biilor Linux pentru bootare verificat\u0103 \u00een modul UEFI Secure Boot, a fost descoperit\u0103 o vulnerabilitate (CVE-2023-40547) care poate duce la executarea de cod de la distan\u021b\u0103.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/udalyonnaya-uyazvimost-v-proslojke-shim-pozvolyayushhaya-obojti-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0435 Shim, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 UEFI Secure Boot | ProHoster","og:description":"\u0412 \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0435 Shim, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0432 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 UEFI Secure Boot, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-40547), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/udalyonnaya-uyazvimost-v-proslojke-shim-pozvolyayushhaya-obojti-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-26T16:50:27+00:00","article:modified_time":"2024-01-26T16:50:27+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/113151","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=113151"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/113151\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=113151"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=113151"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=113151"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}