A fost publicat un set de patch-uri pentru remedierea a 6 vulnerabilit\u0103\u021bi \u00een bootloader-ul GRUB2, majoritatea dintre acestea conduc\u00e2nd la accesarea memoriei dup\u0103 eliberare (use-after-free). Problemele identificate pot fi utilizate pentru a ocoli mecanismul de verificare a \u00eenc\u0103rc\u0103rii UEFI Secure Boot. Starea remedierii vulnerabilit\u0103\u021bilor \u00een distribu\u021bii poate fi evaluat\u0103 pe aceste pagini: Debian, Ubuntu, SUSE, RHEL, Arch \u0219i Fedora. Pentru a rezolva problemele \u00een GRUB2, nu este suficient doar s\u0103 actualiz\u0103m pachetul, este necesar s\u0103 gener\u0103m noi semn\u0103turi digitale interne \u0219i s\u0103 actualiz\u0103m instalatoarele, bootloader-ele, pachetele cu kernel, firmware-ul fwupd \u0219i stratul shim. <\/p>\n
Vulnerabilit\u0103\u021bile identificate: <\/p>\n
\u00cen majoritatea distribu\u021biilor Linux, pentru verificarea \u00eenc\u0103rc\u0103rii \u00een modul UEFI Secure Boot se folose\u0219te un strat mic numit shim, certificat prin semn\u0103tura digital\u0103 a Microsoft. Acest strat verific\u0103 GRUB2 cu propriul certificat, ceea ce permite dezvoltatorilor de distribu\u021bii s\u0103 nu certifice fiecare actualizare a kernel-ului \u0219i GRUB la Microsoft. Vulnerabilit\u0103\u021bile din GRUB2 permit executarea de cod personalizat dup\u0103 verificarea cu succes a shim-ului, dar \u00eenainte de \u00eenc\u0103rcarea sistemului de operare, infiltr\u00e2ndu-se \u00een lan\u021bul de \u00eencredere \u00een modul Secure Boot activ \u0219i ob\u021bin\u00e2nd control total asupra procesului de \u00eenc\u0103rcare ulterioare, de exemplu, pentru a \u00eenc\u0103rca un alt sistem de operare, a modifica componentele sistemului de operare \u0219i a ocoli protec\u021bia Lockdown. <\/p>\n
Pentru blocarea vulnerabilit\u0103\u021bii f\u0103r\u0103 revocarea semn\u0103turii digitale, distribu\u021biile pot utiliza mecanismul SBAT (UEFI Secure Boot Advanced Targeting), pentru care suportul este implementat \u00een GRUB2, shim \u0219i fwupd \u00een cele mai populare distribu\u021bii Linux. SBAT a fost dezvoltat \u00een colaborare cu Microsoft \u0219i prevede ad\u0103ugarea de metadate suplimentare \u00een fi\u0219ierele executabile ale componentelor UEFI, care includ informa\u021bii despre produc\u0103tor, produs, component\u0103 \u0219i versiune. Aceste metadate sunt semnate digital \u0219i pot fi incluse separat \u00een listele de componente permise sau interzise pentru UEFI Secure Boot. <\/p>\n
SBAT permite blocarea utiliz\u0103rii semn\u0103turii digitale pentru anumite versiuni ale componentelor f\u0103r\u0103 a fi necesar\u0103 revocarea cheilor pentru Secure Boot. Blocarea vulnerabilit\u0103\u021bilor prin SBAT nu necesit\u0103 utilizarea listei de certificate revocate UEFI (dbx), \u0219i se realizeaz\u0103 la nivelul \u00eenlocuirii cheii interne pentru formarea semn\u0103turilor \u0219i actualizarea GRUB2, shim \u0219i altor artefacte de boot livrate de distribu\u021bii. P\u00e2n\u0103 la implementarea SBAT, actualizarea listei de certificate revocate (dbx, Lista de Revocare UEFI) era o condi\u021bie obligatorie pentru blocarea complet\u0103 a vulnerabilit\u0103\u021bii, deoarece atacatorul, indiferent de sistemul de operare folosit, putea compromite UEFI Secure Boot utiliz\u00e2nd un mediu de boot cu o versiune veche vulnerabil\u0103 a GRUB2, certificat cu o semn\u0103tur\u0103 digital\u0103. \u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043d\u0430\u0431\u043e\u0440 \u043f\u0430\u0442\u0447\u0435\u0439 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 6 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044e \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u043e\u0441\u043b\u0435 \u0435\u0451 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f (use-after-free). \u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot. \u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u043c\u043e\u0436\u043d\u043e \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u043d\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430\u0445: Debian, Ubuntu, SUSE, RHEL, Arch \u0438 Fedora. \u0414\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-149133","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd476 vulnerabilit\u0103\u021bi \u00een bootloader-ul GRUB2, permi\u021b\u00e2nd ocolirea UEFI Secure Boot | ProHoster","description":"A fost publicat un set de patch-uri pentru remedierea a 6 vulnerabilit\u0103\u021bi \u00een bootloader-ul GRUB2, majoritatea dintre acestea conduc\u00e2nd la accesarea memoriei dup\u0103 eliberare (use-after-free).","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/6-uyazvimostej-v-zagruzchike-grub2-pozvolyayushhih-obojti-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd476 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043e\u0431\u043e\u0439\u0442\u0438 UEFI Secure Boot | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043d\u0430\u0431\u043e\u0440 \u043f\u0430\u0442\u0447\u0435\u0439 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 6 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044e \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u043e\u0441\u043b\u0435 \u0435\u0451 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f (use-after-free).","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/6-uyazvimostej-v-zagruzchike-grub2-pozvolyayushhih-obojti-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-11-21T15:11:55+00:00","article:modified_time":"2025-11-21T15:11:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"149133","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:09:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 16:09:19","updated":"2026-01-23 16:09:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/149133","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=149133"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/149133\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=149133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=149133"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=149133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"