Au fost publicate informa\u021bii despre 21 de vulnerabilit\u0103\u021bi \u00een bootloaderul GRUB2, majoritatea dintre care conduc la dep\u0103\u0219iri de tampon \u0219i pot fi utilizate pentru a ocoli mecanismul de verificare a boot-ului UEFI Secure Boot. Problemele au fost corectate deocamdat\u0103 doar sub forma unui patch. Starea remedierii vulnerabilit\u0103\u021bilor \u00een distribu\u021bii poate fi evaluat\u0103 pe aceste pagini: Debian, Ubuntu, SUSE, RHEL, Fedora. Pentru a remedia problemele \u00een GRUB2, nu este suficient s\u0103 actualiza\u021bi doar pachetul, este necesar s\u0103 genera\u021bi noi semn\u0103turi digitale interne \u0219i s\u0103 actualiza\u021bi instalatoarele, bootloader-ele, pachetele cu kernel, firmware-urile fwupd \u0219i stratul shim. <\/p>\n
Vulnerabilit\u0103\u021bile identificate: <\/p>\n
\u00cen majoritatea distribu\u021biilor Linux, pentru verificarea \u00eenc\u0103rc\u0103rii \u00een modul UEFI Secure Boot se folose\u0219te un strat mic numit shim, certificat prin semn\u0103tura digital\u0103 a Microsoft. Acest strat verific\u0103 GRUB2 cu propriul certificat, ceea ce permite dezvoltatorilor de distribu\u021bii s\u0103 nu certifice fiecare actualizare a kernel-ului \u0219i GRUB la Microsoft. Vulnerabilit\u0103\u021bile din GRUB2 permit executarea de cod personalizat dup\u0103 verificarea cu succes a shim-ului, dar \u00eenainte de \u00eenc\u0103rcarea sistemului de operare, infiltr\u00e2ndu-se \u00een lan\u021bul de \u00eencredere \u00een modul Secure Boot activ \u0219i ob\u021bin\u00e2nd control total asupra procesului de \u00eenc\u0103rcare ulterioare, de exemplu, pentru a \u00eenc\u0103rca un alt sistem de operare, a modifica componentele sistemului de operare \u0219i a ocoli protec\u021bia Lockdown. <\/p>\n
Pentru blocarea vulnerabilit\u0103\u021bii f\u0103r\u0103 revocarea semn\u0103turii digitale, distribu\u021biile pot utiliza mecanismul SBAT (UEFI Secure Boot Advanced Targeting), pentru care suportul este implementat \u00een GRUB2, shim \u0219i fwupd \u00een cele mai populare distribu\u021bii Linux. SBAT a fost dezvoltat \u00een colaborare cu Microsoft \u0219i prevede ad\u0103ugarea de metadate suplimentare \u00een fi\u0219ierele executabile ale componentelor UEFI, care includ informa\u021bii despre produc\u0103tor, produs, component\u0103 \u0219i versiune. Aceste metadate sunt semnate digital \u0219i pot fi incluse separat \u00een listele de componente permise sau interzise pentru UEFI Secure Boot. <\/p>\n
SBAT permite blocarea utiliz\u0103rii semn\u0103turii digitale pentru anumite versiuni ale componentelor f\u0103r\u0103 a fi necesar\u0103 revocarea cheilor pentru Secure Boot. Blocarea vulnerabilit\u0103\u021bilor prin SBAT nu necesit\u0103 utilizarea listei de certificate revocate UEFI (dbx), \u0219i se realizeaz\u0103 la nivelul \u00eenlocuirii cheii interne pentru formarea semn\u0103turilor \u0219i actualizarea GRUB2, shim \u0219i altor artefacte de boot livrate de distribu\u021bii. P\u00e2n\u0103 la implementarea SBAT, actualizarea listei de certificate revocate (dbx, Lista de Revocare UEFI) era o condi\u021bie obligatorie pentru blocarea complet\u0103 a vulnerabilit\u0103\u021bii, deoarece atacatorul, indiferent de sistemul de operare folosit, putea compromite UEFI Secure Boot utiliz\u00e2nd un mediu de boot cu o versiune veche vulnerabil\u0103 a GRUB2, certificat cu o semn\u0103tur\u0103 digital\u0103. \u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e 21 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u043e\u043a\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u0438\u0434\u0435 \u043f\u0430\u0442\u0447\u0430. \u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u043c\u043e\u0436\u043d\u043e \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u043d\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430\u0445: Debian, Ubuntu, SUSE, RHEL, Fedora. \u0414\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0432 GRUB2 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-122049","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd4721 de vulnerabilit\u0103\u021bi identificate \u00een \u00eenc\u0103rc\u0103torul GRUB2 | ProHoster","description":"Au fost publicate informa\u021bii despre 21 de vulnerabilit\u0103\u021bi \u00een \u00eenc\u0103rc\u0103torul GRUB2, majoritatea dintre acestea duc\u00e2nd la overflow de buffer \u0219i put\u00e2nd fi folosite pentru a eluda mecanismul de verificare a \u00eenc\u0103rc\u0103rii UEFI Secure Boot.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-zagruzchike-grub2-vyyavlena-21-uyazvimost","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 21 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e 21 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-zagruzchike-grub2-vyyavlena-21-uyazvimost","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-22T00:22:05+00:00","article:modified_time":"2025-02-22T00:22:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"122049","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 10:50:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:50:19","updated":"2026-01-23 10:50:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/122049","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=122049"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/122049\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=122049"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=122049"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=122049"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"