{"id":119554,"date":"2024-08-21T09:43:00","date_gmt":"2024-08-21T07:43:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/oshibka-v-obnovlenii-k-windows-blokirovala-zagruzku-linux-pri-ispolzovanii-uefi-secure-boot"},"modified":"2024-08-21T09:43:00","modified_gmt":"2024-08-21T07:43:00","slug":"oshibka-v-obnovlenii-k-windows-blokirovala-zagruzku-linux-pri-ispolzovanii-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/oshibka-v-obnovlenii-k-windows-blokirovala-zagruzku-linux-pri-ispolzovanii-uefi-secure-boot","title":{"rendered":"Chyba v aktualiz\u00e1cii na Windows br\u00e1nila na\u010d\u00edtaniu Linuxu pri pou\u017eit\u00ed UEFI Secure Boot","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V aktualiz\u00e1cii opera\u010dn\u00e9ho syst\u00e9mu Windows, ktor\u00fa v utorok vydala spolo\u010dnos\u0165 Microsoft, bola zisten\u00e1 chyba, ktor\u00e1 sp\u00f4sobuje nemo\u017enos\u0165 spustenia Linuxov\u00fdch syst\u00e9mov in\u0161talovan\u00fdch na tom istom po\u010d\u00edta\u010di paralelne s Windows. Pr\u00ed\u010dinou probl\u00e9mov je oprava zameran\u00e1 na odstr\u00e1nenie starej zranite\u013enosti (CVE-2022-2601) v bootloaderi GRUB, ktor\u00e1 bola opraven\u00e1 v roku 2022. Spolo\u010dnos\u0165 Microsoft zatia\u013e neposkytla \u017eiadne vyhl\u00e1senia t\u00fdkaj\u00face sa vzniknut\u00e9ho probl\u00e9mu a nijako ho nekomentovala. <\/p>\n

V pozn\u00e1mke k zmene sa uv\u00e1dzalo, \u017ee oprava, ktor\u00e1 zabezpe\u010duje zavedenie novej politiky SBAT (UEFI Secure Boot Advanced Targeting), bude aplikovan\u00e1 na syst\u00e9my, ktor\u00e9 pou\u017e\u00edvaj\u00fa iba Windows a nebude sa dot\u00fdka\u0165 konfigur\u00e1ci\u00ed s dvojit\u00fdm sp\u00fa\u0161\u0165an\u00edm (zm\u011bna zablokovala mo\u017enos\u0165 pou\u017e\u00edva\u0165 bootovacie obrazy so star\u00fdm GRUB na ob\u00eddenie Secure Boot na syst\u00e9moch, na ktor\u00fdch je nain\u0161talovan\u00fd iba Windows). Tie\u017e sa uv\u00e1dzalo, \u017ee t\u00e1to zmena m\u00f4\u017ee sp\u00f4sobi\u0165 probl\u00e9my so sp\u00fa\u0161\u0165an\u00edm iso obrazov star\u00fdch syst\u00e9mov dod\u00e1van\u00fdch s zranite\u013enou verziou GRUB. V praxi sa probl\u00e9my prejavili aj u pou\u017e\u00edvate\u013eov syst\u00e9mov s dvojit\u00fdm sp\u00fa\u0161\u0165an\u00edm, ktor\u00ed pou\u017e\u00edvaj\u00fa nov\u00e9 distrib\u00facie Linuxu, ako s\u00fa Ubuntu 24.04 a Debian 12.6, v ktor\u00fdch bola zranite\u013enos\u0165 v GRUB d\u00e1vno opraven\u00e1. <\/p>\n

Probl\u00e9m sa prejavuje zastaven\u00edm procesu na\u010d\u00edtania s v\u00fdstupom spr\u00e1vy \u201eVerifying shim SBAT data failed: Security Policy Violation. Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation\u201c. Ako sp\u00f4sob obnovenia funk\u010dnosti sa odpor\u00fa\u010da odstr\u00e1ni\u0165 nain\u0161talovan\u00e9 \u00fadaje SBAT v UEFI, na \u010do je mo\u017en\u00e9 vypn\u00fa\u0165 Secure Boot v firme, na\u010d\u00edta\u0165 \u010derstv\u00fd Linux distrib\u00faciu s podporou UEFI Secure Boot, napr\u00edklad Ubuntu, a vykona\u0165 v konzole pr\u00edkaz \u201emokutil \u2014set-sbat-policy delete\u201c, po ktorom je potrebn\u00e9 re\u0161tartova\u0165 Linux distrib\u00faciu na nastavenie spr\u00e1vnej politiky SBAT. Potom je mo\u017en\u00e9 vr\u00e1ti\u0165 re\u017eim Secure Boot vo firme. <\/p>\n

Mechanizmus SBAT bol vyvinut\u00fd spolo\u010dnos\u0165ou Red Hat v spolupr\u00e1ci s Microsoftom na blokovanie zranite\u013enost\u00ed v boot manageri GRUB a v shim vrstve bez potreby odvolania digit\u00e1lnych podpisov. SBAT zah\u0155\u0148a pridanie dodato\u010dn\u00fdch metad\u00e1t do vykonate\u013en\u00fdch s\u00faborov komponentov UEFI, ktor\u00e9 obsahuj\u00fa inform\u00e1cie o v\u00fdrobcovi, produkte, komponente a verzii. Uveden\u00e9 metad\u00e1ta s\u00fa digit\u00e1lne podp\u00edsan\u00e9 a m\u00f4\u017eu by\u0165 samostatne zahrnut\u00e9 do zoznamov povolen\u00fdch alebo zak\u00e1zan\u00fdch komponentov pre UEFI Secure Boot. SBAT umo\u017e\u0148uje blokovanie pou\u017eitia digit\u00e1lneho podpisu pre jednotliv\u00e9 \u010d\u00edsla verzi\u00ed komponentov bez nutnosti odvola\u0165 k\u013e\u00fa\u010de pre Secure Boot. <\/p>\n

Blokovanie zranite\u013enost\u00ed pomocou SBAT nevy\u017eaduje pou\u017e\u00edvanie zoznamu odvolan\u00fdch certifik\u00e1tov UEFI (dbx), ale prebieha na \u00farovni v\u00fdmeny intern\u00e9ho k\u013e\u00fa\u010da na tvorbu podpisov a aktualiz\u00e1ciu GRUB2, shim a \u010fal\u0161\u00edch dod\u00e1van\u00fdch bootovac\u00edch artefaktov. Pred zaveden\u00edm SBAT bolo aktualizovanie zoznamu odvolan\u00fdch certifik\u00e1tov (dbx, UEFI Revocation List) povinnou podmienkou na \u00fapln\u00e9 blokovanie zranite\u013enosti, preto\u017ee \u00fato\u010dn\u00edk, bez oh\u013eadu na pou\u017e\u00edvan\u00fd opera\u010dn\u00fd syst\u00e9m, mohol na kompromit\u00e1ciu UEFI Secure Boot pou\u017ei\u0165 bootovacie m\u00e9dium so starou zranite\u013enou verziou GRUB2, podp\u00edsanou digit\u00e1lnym podpisom.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u043c \u0432\u043e \u0432\u0442\u043e\u0440\u043d\u0438\u043a \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Microsoft \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043a \u041e\u0421 Windows \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Linux-\u0441\u0438\u0441\u0442\u0435\u043c, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u0442\u043e\u043c \u0436\u0435 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u0441 Windows. \u041f\u0440\u0438\u0447\u0438\u043d\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0435 \u043d\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0441\u0442\u0430\u0440\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-2601) \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432 2022 \u0433\u043e\u0434\u0443. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u043f\u043e\u043a\u0430 \u043d\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u0438\u044f, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0432\u043e\u0437\u043d\u0438\u043a\u0448\u0438\u043c \u0441\u0431\u043e\u0435\u043c \u0438 \u043d\u0438\u043a\u0430\u043a \u0435\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-119554","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Chyba v aktualiz\u00e1cii pre Windows zablokovala spustenie Linuxu pri pou\u017eit\u00ed UEFI Secure Boot | ProHoster","description":"V utorok vydan\u00e1 aktualiz\u00e1cia od spolo\u010dnosti Microsoft do opera\u010dn\u00e9ho syst\u00e9mu Windows odhalila probl\u00e9m, ktor\u00fd br\u00e1ni spusteniu Linuxov\u00fdch syst\u00e9mov nain\u0161talovan\u00fdch na tom istom po\u010d\u00edta\u010di paralelne s Windows.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/oshibka-v-obnovlenii-k-windows-blokirovala-zagruzku-linux-pri-ispolzovanii-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0448\u0438\u0431\u043a\u0430 \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043a Windows \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 Linux \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 UEFI Secure Boot | ProHoster","og:description":"\u0412 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u043c \u0432\u043e \u0432\u0442\u043e\u0440\u043d\u0438\u043a \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Microsoft \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043a \u041e\u0421 Windows \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Linux-\u0441\u0438\u0441\u0442\u0435\u043c, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u0442\u043e\u043c \u0436\u0435 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u0441 Windows.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/oshibka-v-obnovlenii-k-windows-blokirovala-zagruzku-linux-pri-ispolzovanii-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-08-21T07:43:00+00:00","article:modified_time":"2024-08-21T07:43:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"119554","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 06:03:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 06:03:19","updated":"2026-01-23 06:03:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/119554","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=119554"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/119554\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=119554"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=119554"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=119554"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}