Boli zverejnen\u00e9 inform\u00e1cie o 21 zranite\u013enosti v na\u010d\u00edta\u010di GRUB2, z ktor\u00fdch v\u00e4\u010d\u0161ina vedie k prete\u010deniu z\u00e1sobn\u00edka a m\u00f4\u017ee by\u0165 pou\u017eit\u00e1 na ob\u00eddenie mechanizmu overenej agres\u00edvneho spustenia UEFI Secure Boot. Probl\u00e9my boli zatia\u013e opraven\u00e9 iba vo forme opr\u00e1v. Stav odstr\u00e1nenia zranite\u013enost\u00ed v distrib\u00faci\u00e1ch je mo\u017en\u00e9 pos\u00fadi\u0165 na nasleduj\u00facich str\u00e1nkach: Debian, Ubuntu, SUSE, RHEL, Fedora. Na odstr\u00e1nenie probl\u00e9mov v GRUB2 nesta\u010d\u00ed len aktualizova\u0165 bal\u00edk, je taktie\u017e potrebn\u00e9 vytvori\u0165 nov\u00e9 vn\u00fatorn\u00e9 digit\u00e1lne podpisy a aktualizova\u0165 in\u0161tal\u00e1tory, zav\u00e1dza\u010de, bal\u00edky s jadrom, fwupd firmv\u00e9r a shim prepojovac\u00ed softv\u00e9r. <\/p>\n
Odhalen\u00e9 zranite\u013enosti: <\/p>\n
Vo v\u00e4\u010d\u0161ine Linux distrib\u00faci\u00ed sa na overen\u00fa bootovanie v re\u017eime UEFI Secure Boot pou\u017e\u00edva mal\u00e1 vrstva shim, ktor\u00e1 je certifikovan\u00e1 digit\u00e1lnym podpisom spolo\u010dnosti Microsoft. T\u00e1to vrstva overuje GRUB2 vlastn\u00fdm certifik\u00e1tom, \u010do umo\u017e\u0148uje v\u00fdvoj\u00e1rom distrib\u00faci\u00ed netransferova\u0165 ka\u017ed\u00fa aktualiz\u00e1ciu kernela a GRUB do spolo\u010dnosti Microsoft. Zranite\u013enosti v GRUB2 umo\u017e\u0148uj\u00fa vykonanie vlastn\u00e9ho k\u00f3du v \u0161t\u00e1diu po \u00faspe\u0161nom overen\u00ed shim, ale pred na\u010d\u00edtan\u00edm opera\u010dn\u00e9ho syst\u00e9mu, \u010d\u00edm sa prenik\u00e1 do re\u0165azca d\u00f4very pri akt\u00edvnom re\u017eime Secure Boot a z\u00edskava sa \u00fapln\u00e1 kontrola nad \u010fal\u0161\u00edm procesom sp\u00fa\u0161\u0165ania, napr\u00edklad na na\u010d\u00edtanie in\u00e9ho OS, modifik\u00e1ciu komponentov opera\u010dn\u00e9ho syst\u00e9mu a ob\u00eddenie ochrany Lockdown. <\/p>\n
Na blokovanie zranite\u013enost\u00ed bez odvolania digit\u00e1lneho podpisu m\u00f4\u017eu distrib\u00facie pou\u017e\u00edva\u0165 mechanizmus SBAT (UEFI Secure Boot Advanced Targeting), ktor\u00e9ho podpora je implementovan\u00e1 pre GRUB2, shim a fwupd vo v\u00e4\u010d\u0161ine popul\u00e1rnych distrib\u00faci\u00ed Linuxu. SBAT bol vyvinut\u00fd v spolupr\u00e1ci s Microsoftom a znamen\u00e1 pr\u00eddavok do spustite\u013en\u00fdch s\u00faborov komponentov UEFI \u010fal\u0161\u00edch metad\u00e1t, ktor\u00e9 obsahuj\u00fa inform\u00e1cie o v\u00fdrobca, produkte, komponente a verzii. Uveden\u00e9 metadata s\u00fa digit\u00e1lne podp\u00edsan\u00e9 a m\u00f4\u017eu by\u0165 samostatne zahrnut\u00e9 do zoznamov povolen\u00fdch alebo zak\u00e1zan\u00fdch komponentov pre UEFI Secure Boot. <\/p>\n
SBAT umo\u017e\u0148uje blokova\u0165 pou\u017e\u00edvanie digit\u00e1lneho podpisu pre jednotliv\u00e9 verzie komponentov bez potreby odvola\u0165 k\u013e\u00fa\u010de pre Secure Boot. Blokovanie zranite\u013enost\u00ed cez SBAT nevy\u017eaduje pou\u017eitie zoznamu odvolan\u00fdch certifik\u00e1tov UEFI (dbx), ale realizuje sa na \u00farovni nahradenia intern\u00e9ho k\u013e\u00fa\u010da na vytv\u00e1ranie podpisov a aktualiz\u00e1ciu GRUB2, shim a \u010fal\u0161\u00edch dod\u00e1van\u00fdch distribuovan\u00fdch boot artefaktov. Pred zaveden\u00edm SBAT bolo aktualizovanie zoznamu odvolan\u00fdch certifik\u00e1tov (dbx, UEFI Revocation List) nevyhnutnou podmienkou pre \u00fapln\u00e9 blokovanie zranite\u013enosti, preto\u017ee \u00fato\u010dn\u00edk, bez oh\u013eadu na pou\u017eit\u00fd opera\u010dn\u00fd syst\u00e9m, mohol na kompromit\u00e1ciu UEFI Secure Boot pou\u017ei\u0165 bootovac\u00ed nosi\u010d so starou zranite\u013enou verziou GRUB2, certifikovan\u00fa digit\u00e1lnym podpisom. \u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e 21 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u043e\u043a\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u0438\u0434\u0435 \u043f\u0430\u0442\u0447\u0430. \u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u043c\u043e\u0436\u043d\u043e \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u043d\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430\u0445: Debian, Ubuntu, SUSE, RHEL, Fedora. \u0414\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0432 GRUB2 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-122049","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47V bootloaderi GRUB2 bolo identifikovan\u00fdch 21 zranite\u013enost\u00ed | ProHoster","description":"Boli zverejnen\u00e9 inform\u00e1cie o 21 zranite\u013enostiach v bootloaderi GRUB2, z ktor\u00fdch v\u00e4\u010d\u0161ina vedie k prete\u010deniu z\u00e1sobn\u00edka a m\u00f4\u017ee by\u0165 vyu\u017eit\u00e1 na ob\u00eddenie mechanizmu overenej sp\u00fa\u0161\u0165ania UEFI Secure Boot.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/v-zagruzchike-grub2-vyyavlena-21-uyazvimost","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 21 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e 21 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB2, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 UEFI Secure Boot.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/v-zagruzchike-grub2-vyyavlena-21-uyazvimost","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-22T00:22:05+00:00","article:modified_time":"2025-02-22T00:22:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"122049","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 10:50:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:50:19","updated":"2026-01-23 10:50:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/122049","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=122049"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/122049\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=122049"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=122049"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=122049"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"