{"id":104320,"date":"2022-06-08T15:36:43","date_gmt":"2022-06-08T13:36:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-grub2-pozvolyayushhie-obojti-uefi-secure-boot"},"modified":"2022-06-08T15:36:43","modified_gmt":"2022-06-08T13:36:43","slug":"uyazvimosti-v-grub2-pozvolyayushhie-obojti-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-grub2-pozvolyayushhie-obojti-uefi-secure-boot","title":{"rendered":"Vulnerabilitetet n\u00eb GRUB2, q\u00eb lejojn\u00eb p\u00ebrjashtimin e UEFI Secure Boot","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb shkarkuesin GRUB2 jan\u00eb zgjidhur 7 vulnerabilitete q\u00eb lejojn\u00eb q\u00eb mekanizmi UEFI Secure Boot t\u00eb kaloj\u00eb, duke mund\u00ebsuar ekzekutimin e kodit t\u00eb pav\u00ebrtetuar, p\u00ebr shembull, t\u00eb mb\u00ebshtjelljes s\u00eb malware-it q\u00eb operon n\u00eb nivelin e shkarkuesit ose b\u00ebrtham\u00ebs. Shtohet gjithashtu nj\u00eb vulnerabilitet n\u00eb shtres\u00ebn shim, q\u00eb gjithashtu lejon kalimin e UEFI Secure Boot. Grupi i vulnerabiliteteve mori emrin kodor Boothole 3, n\u00eb m\u00ebnyr\u00eb t\u00eb ngjashme me problemet e ngjashme q\u00eb jan\u00eb identifikuar m\u00eb par\u00eb n\u00eb shkarkuesin. <\/p>\n
P\u00ebr t\u00eb zgjidhur problemet n\u00eb GRUB2 dhe shim, shp\u00ebrndarjet do t\u00eb mund t\u00eb p\u00ebrdorin mekanizmin SBAT (UEFI Secure Boot Advanced Targeting), mb\u00ebshtetje p\u00ebr t\u00eb cilin \u00ebsht\u00eb realizuar p\u00ebr GRUB2, shim dhe fwupd. SBAT \u00ebsht\u00eb zhvilluar n\u00eb bashk\u00ebpunim me Microsoft dhe parashikon shtimin n\u00eb skedar\u00ebt ekzekutiv\u00eb t\u00eb komponent\u00ebve UEFI t\u00eb metadatis\u00eb shtes\u00eb, e cila p\u00ebrfshin informacion rreth prodhuesit, produktit, komponentit dhe versionit. K\u00ebto metadata n\u00ebnshkruhen digjitalisht dhe mund t\u00eb p\u00ebrfshihen ve\u00e7mas n\u00eb listat e komponent\u00ebve t\u00eb lejuar ose t\u00eb ndaluar p\u00ebr UEFI Secure Boot. <\/p>\n
N\u00eb shumic\u00ebn e shp\u00ebrndarjeve Linux, p\u00ebr ngarkimin e verifikuar n\u00eb m\u00ebnyr\u00ebn UEFI Secure Boot p\u00ebrdoret nj\u00eb shtres\u00eb e vog\u00ebl shim, e n\u00ebnshkruar digjitalisht nga Microsoft. Kjo shtres\u00eb verifikon GRUB2 me certifikat\u00ebn e saj, duke lejuar zhvilluesit e shp\u00ebrndarjeve t\u00eb mos n\u00ebnshkruajn\u00eb \u00e7do p\u00ebrdit\u00ebsim t\u00eb b\u00ebrtham\u00ebs dhe GRUB te Microsoft. Vulnerabilitetet n\u00eb GRUB2 lejojn\u00eb ekzekutimin e kodit t\u00eb tij pas suksesit t\u00eb verifikimit t\u00eb shim, por para ngarkimit t\u00eb sistemit operativ, duke nd\u00ebrhyr\u00eb n\u00eb zinxhirin e besimit gjat\u00eb aktivizimit t\u00eb Secure Boot dhe duke fituar kontroll t\u00eb plot\u00eb mbi procesin e ngarkimit, duke p\u00ebrfshir\u00eb ngarkimin e nj\u00eb sistemi operativ tjet\u00ebr, modifikimin e komponent\u00ebve t\u00eb sistemit operativ dhe kalimin e mbrojtjes Lockdown. <\/p>\n
P\u00ebr t\u00eb zgjidhur problemet n\u00eb shkarkues, shp\u00ebrndarjet do t\u00eb duhet t\u00eb formulojn\u00eb n\u00ebnshkrime t\u00eb reja digjitale t\u00eb brendshme dhe t\u00eb azhurnojn\u00eb instaluesit, shkarkuesit, paketat e b\u00ebrtham\u00ebs, firmat fwupd dhe shtres\u00ebn shim. Deri n\u00eb implementimin e SBAT, azhurnimi i list\u00ebs s\u00eb certifikatave t\u00eb revokuara (dbx, UEFI Revocation List) ishte nj\u00eb kusht i domosdosh\u00ebm p\u00ebr bllokimin e plot\u00eb t\u00eb vulnerabilitetit, pasi sulmuesi, pavar\u00ebsisht nga sistemi operativ i p\u00ebrdorur, mund t\u00eb p\u00ebrdor\u00eb nj\u00eb bart\u00ebs ngarkimi me nj\u00eb version t\u00eb vjet\u00ebr dhe t\u00eb vulnerab\u00ebl t\u00eb GRUB2, i n\u00ebnshkruar digjitalisht. <\/p>\n
N\u00eb vend t\u00eb anulimit, n\u00ebnshkrimi SBAT lejon bllokimin e p\u00ebrdorimit t\u00eb tij p\u00ebr versione t\u00eb caktuara komponent\u00ebsh pa nevoj\u00ebn p\u00ebr t\u00eb anuluar \u00e7el\u00ebsat p\u00ebr Secure Boot. Bllokimi i vulnerabiliteteve p\u00ebrmes SBAT nuk k\u00ebrkon p\u00ebrdorimin e list\u00ebs s\u00eb \u00e7ertifikatave t\u00eb anuluara UEFI (dbx), dhe realizohet n\u00eb nivelin e z\u00ebvend\u00ebsimit t\u00eb \u00e7el\u00ebsit t\u00eb brendsh\u00ebm p\u00ebr formimin e n\u00ebnshkrimeve dhe p\u00ebrdit\u00ebsimin e GRUB2, shim dhe artefakteve t\u00eb tjera t\u00eb ngarkes\u00ebs t\u00eb ofruara nga distro-t. Aktualisht, mb\u00ebshtetje p\u00ebr SBAT tashm\u00eb \u00ebsht\u00eb shtuar n\u00eb shumic\u00ebn e distro-ve t\u00eb njohura Linux. <\/p>\n
Vulnerabilitetet e identifikuara: <\/p>\n
\n
CVE-2021-3696, CVE-2021-3695 - mbushje e buffers n\u00eb heap gjat\u00eb p\u00ebrpunimit t\u00eb imazheve PNG t\u00eb strukturuara n\u00eb m\u00ebnyr\u00eb speciale, t\u00eb cilat teoretikisht mund t\u00eb p\u00ebrdoren p\u00ebr organizimin e ekzekutimit t\u00eb kodit t\u00eb sulmuesit dhe kalimin e UEFI Secure Boot. V\u00ebmendje se problemi \u00ebsht\u00eb i v\u00ebshtir\u00eb p\u00ebr t'u shfryt\u00ebzuar, pasi krijimi i nj\u00eb eksploit t\u00eb punuesh\u00ebm k\u00ebrkon nj\u00eb num\u00ebr t\u00eb madh faktor\u00ebsh dhe njohuri mbi shp\u00ebrndarjen e memories.\n
CVE-2021-3697 - mbushje p\u00ebrmes kufirit t\u00eb posht\u00ebm t\u00eb buffers (buffer underflow) n\u00eb kodin e p\u00ebrpunimit t\u00eb imazheve JPEG. Shfryt\u00ebzimi i problemit k\u00ebrkon marr\u00ebdh\u00ebnie mbi shp\u00ebrndarjen e memories dhe \u00ebsht\u00eb n\u00eb nj\u00eb nivel t\u00eb ngjash\u00ebm kompleksiteti si problemi me PNG (CVSS 7.5).\n
CVE-2022-28733 \u2014 mbushje t\u00eb numrave t\u00eb plot\u00eb n\u00eb funksionin grub_net_recv_ip4_packets(), e cila leht\u00ebson ndikimin n\u00eb parametrin rsm->total_len p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb pakete IP t\u00eb strukturuar posa\u00e7\u00ebrisht. Problemi \u00ebsht\u00eb sh\u00ebnuar si m\u00eb t\u00eb rrezikshme nga t\u00eb dh\u00ebna t\u00eb paraqitura (CVSS 8.1). Me nj\u00eb shfryt\u00ebzim t\u00eb suksessh\u00ebm, vulnerabiliteti lejon regjistrimin e t\u00eb dh\u00ebnave p\u00ebrtej kufirit t\u00eb buffers p\u00ebrmes alokimit t\u00eb nj\u00eb memorje t\u00eb qart\u00eb m\u00eb e vog\u00ebl n\u00eb madh\u00ebsi.\n
CVE-2022-28734 \u2014 mbushje e nj\u00eb byte buffers gjat\u00eb p\u00ebrpunimit t\u00eb titujve HTTP t\u00eb ndar\u00eb. Problemi mund t\u00eb \u00e7oj\u00eb n\u00eb d\u00ebmtimin e metadata-ve GRUB2 (shkruar nj\u00eb byte zero menj\u00ebher\u00eb pas fundi t\u00eb buffers) gjat\u00eb analisis\u00eb s\u00eb HTTP-requests t\u00eb strukturuara posa\u00e7\u00ebrisht.\n
CVE-2022-28735 \u2014 nj\u00eb problem n\u00eb verifikuesin shim_lock, e cila lejon ngarkimin e skedar\u00ebve q\u00eb nuk i p\u00ebrkasin b\u00ebrtham\u00ebs. Vulnerabiliteti mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb ngarkuar n\u00eb modin UEFI Secure Boot module t\u00eb b\u00ebrtham\u00ebs q\u00eb nuk kan\u00eb n\u00ebnshkrim digjital t\u00eb verifikuar ose kod t\u00eb pav\u00ebrtetuar.\n
CVE-2022-28736 \u2014 nj\u00eb referenc\u00eb n\u00eb nj\u00eb zon\u00eb memorje t\u00eb liruar tashm\u00eb n\u00eb funksionin grub_cmd_chainloader() p\u00ebrmes rip\u00ebrs\u00ebritjes s\u00eb komand\u00ebs chainloader, e cila p\u00ebrdoret p\u00ebr ngarkimin e sistemeve operative q\u00eb nuk mb\u00ebshteten n\u00eb GRUB2. Shfryt\u00ebzimi mund t\u00eb p\u00ebrfundoj\u00eb me ekzekutimin e kodit t\u00eb sulmuesit, n\u00ebse sulmuesi \u00ebsht\u00eb n\u00eb gjendje t\u00eb p\u00ebrcaktoj\u00eb karakteristikat e shp\u00ebrndarjes s\u00eb memories n\u00eb GRUB2.\n