Ruzivo rwakaburitswa nezve 8 kusasimba muGRUB2 bootloader, iyo inokutendera kuti upfuure iyo UEFI Yakachengeteka Boot maitiro uye kumhanya isina kusimbiswa kodhi, semuenzaniso, shandisa malware inomhanya pabootloader kana kernel level.
Ngatiyeukei kuti muhuwandu hwekugoverwa kweLinux, kune yakasimbiswa booting muUEFI Yakachengeteka Boot mode, diki shim layer inoshandiswa, yakasainwa neMicrosoft. Iyi nhanho inosimbisa GRUB2 nechitupa chayo, iyo inobvumira vanogadzira kugovera kuti vasave nechero kernel uye GRUB update yakasimbiswa neMicrosoft. Kusagadzikana muGRUB2 kunobvumidza iwe kuti uwane kuitiswa kwekodhi yako pachinhanho mushure mekubudirira shim verification, asi usati warodha sisitimu yekushandisa, kupinda muketani yekuvimba kana Chengetedza Boot mode ichishanda uye kuwana hutongi hwakazara pamusoro peimwe bhutsu maitiro, kusanganisira. kurodha imwe OS, kugadzirisa masisitimu ekushandisa masisitimu uye nekupfuura Lockdown dziviriro.
Sezvakaita neBootHole yegore rapfuura kusadzivirirwa, kuvandudza iyo bootloader haina kukwana kuvharira dambudziko, sezvo anorwisa, zvisinei neiyo inoshanda sisitimu inoshandiswa, anogona kushandisa bootable media nekare, yakasainwa nedhijitari, isina njodzi vhezheni yeGRUB2 kukanganisa UEFI Yakachengeteka Boot. Dambudziko rinogona kugadziriswa chete nekuvandudza rondedzero yekudzosa chitupa (dbx, UEFI Revocation Rondedzero), asi mune iyi kesi kugona kushandisa yekare yekuisa media neLinux kucharasika.
Pane masisitimu ane firmware ine yakagadziridzwa chitupa yekudzosa rondedzero, chete yakagadziridzwa inovaka yeLinux kugovera inogona kurodha muUEFI Yakachengeteka Boot mode. Kugovera kunoda kuvandudza vanoisa, bootloaders, kernel mapakeji, fwupd firmware uye shim layer, ichigadzira mitsva yemasiginecha kwavari. Vashandisi vanozodiwa kuti vagadzirise yekuisa mifananidzo uye mamwe mabhootable midhiya, pamwe nekurodha reti revocation list (dbx) muEFI firmware. Usati wagadziridza dbx kuUEFI, sisitimu inoramba iri panjodzi zvisinei nekuiswa kwezvigadziriso muOS. Mamiriro ekusagadzikana anogona kuongororwa pamapeji aya: Ubuntu, SUSE, RHEL, Debian.
Kugadzirisa matambudziko anomuka pakugovera zvitupa zvakabviswa, mune ramangwana rakarongwa kushandisa iyo SBAT (UEFI Secure Boot Advanced Targeting) nzira, tsigiro yakaitwa yeGRUB2, shim uye fwupd, uye kutanga kubva kune inotevera inogadziridza ichave. inoshandiswa pachinzvimbo chekushanda kwakapihwa ne dbxtool package. SBAT yakagadziridzwa pamwe chete neMicrosoft uye inosanganisira kuwedzera metadata itsva kumafaira eUEFI anogoneka, ayo anosanganisira ruzivo nezve mugadziri, chigadzirwa, chikamu uye shanduro. Iyo metadata yakatsanangurwa inosimbiswa nedhijitari siginicha uye inogona zvakare kuverengerwa muzvinyorwa zvinotenderwa kana zvinorambidzwa zvikamu zveUEFI Secure Boot. Saka, SBAT ichakubvumidza kuti ushandise nhamba yechikamu cheshanduro panguva yekudzingwa pasina chikonzero chekuvandudza makiyi eSecure Boot uye pasina kugadzira siginecha nyowani yekernel, shim, grub2 uye fwupd.
Zvinozivikanwa vulnerabilities:
- CVE-2020-14372 - Uchishandisa iyo acpi command muGRUB2, mushandisi ane rombo pane yemuno sisitimu anogona kurodha matafura eACPI akagadziridzwa nekuisa SSDT (Secondary System Tsanangudzo Tafura) mu /boot/efi dhairekitori uye kuchinja marongero mu grub.cfg. Kunyangwe Chengetedza Boot mode inoshanda, iyo yakatsanangurwa SSDT ichaitwa nekernel uye inogona kushandiswa kudzima LockDown dziviriro inovhara UEFI Chengetedza Boot yekupfuura nzira. Nekuda kweizvozvo, munhu anorwisa anogona kuwana kurodha yake kernel module kana kumhanya kodhi kuburikidza nekexec mechanism, pasina kutarisa siginecha yedhijitari.
- CVE-2020-25632 ndeyekushandisa-mushure-yemahara ndangariro yekuwana mukuitwa kweiyo rmmod command, inoitika kana kuyedza kuburitsa chero module pasina kufunga nezvekutsamira kwakabatana nayo. Kusagadzikana hakusanganisire kugadzirwa kwekushandisa kunogona kutungamira kukuita kodhi nekupfuura Chengetedza Boot verification.
- CVE-2020-25647 An-out-of-bounds nyora mune grub_usb_device_initialize() basa rinodaidzwa kana uchitanga USB zvishandiso. Dambudziko rinogona kushandiswa nekubatanidza yakanyatsogadzirirwa USB mudziyo unoburitsa ma parameter ayo saizi yake isingaenderane nehukuru hwebuffer yakagoverwa kune USB zvimiro. Anorwisa anogona kuwana kuurayiwa kwekodhi iyo isina kusimbiswa muYakachengeteka Boot nekushandisa USB zvishandiso.
- CVE-2020-27749 is a buffer overflow in the grub_parser_split_cmdline() function, iyo inogona kukonzerwa nekutsanangura zvinosiyana zvakakura kupfuura 2 KB pamutsetse wemirairo weGRUB1. Kusagadzikana kunobvumira kodhi kuuraya kupfuura Chengetedza Boot.
- CVE-2020-27779 - Murairo we cutmem unobvumira munhu anorwisa kubvisa huwandu hwekero kubva mundangariro kuti apfuure Chengetedza Boot.
- CVE-2021-3418 - Shanduko ku shim_lock yakagadzira imwe vheji yekushandisa kushandisa kusagadzikana kwegore rapfuura CVE-2020-15705. Nekuisa chitupa chinoshandiswa kusaina GRUB2 mudbx, GRUB2 yakabvumira chero kernel kuti itakurwe zvakananga pasina kusimbisa siginecha.
- CVE-2021-20225 -Kugona kwekunyora kunze-kwe-yekumisikidzwa data paunenge uchimhanyisa mirairo ine nhamba yakakura kwazvo yesarudzo.
- CVE-2021-20233 -Kugona kwekunyora data kunze kwemuganho nekuda kweiyo isiriyo buffer size yekuverenga kana uchishandisa makotesheni. Pakuverengwa ukuru, kwaifungidzirwa kuti mavara matatu aidiwa kutiza chirevo chimwe chete, asi chaizvoizvo mana aidiwa.
Source: opennet.ru