An exploit for the 0-day vulnerability is already being sold on relevant forums.
On June 21, information about the sale of an exploit for a zero-day vulnerability in the GRUB bootloader for Linux, allowing local privilege escalation (LPE), appeared on one of the forums.
According to Dark Web Intelligence, the attacker claims to have found a vulnerability in GRUB that allows bypassing authentication mechanisms and gaining root access to the system.
According to a post by a member of a dark forum under the nickname 'Cas', the vulnerability affects GRUB — a critical component of most Linux systems that manages the boot process, allowing attackers to install hidden and persistent malware, which can be quite difficult to detect and remove. The exploit is being sold for $90,000.
It is worth noting that GRUB has been targeted by attacks in the past. In 2015, a vulnerability CVE-2015-8370 was discovered, allowing authentication to be bypassed by pressing the backspace key 28 times during the user name input phase in GRUB. This vulnerability affected GRUB versions from 1.98 to 2.02 and was widely exploited until a patch was released. In 2020, another vulnerability was identified — CVE-2020-10713, known as BootHole, which allowed malware to be installed during the boot process.
Major Linux distributions, such as Debian, RedHat, and Ubuntu, quickly released recommendations and patches for previous GRUB vulnerabilities and are likely to do the same this time. However, the situation is complicated by the fact that the vulnerability was discovered by malicious actors rather than ethical hackers. This means that its discovery and fixing by security researchers may take significantly longer.
Burimi: linux.org.ru
