{"id":104320,"date":"2022-06-08T15:36:43","date_gmt":"2022-06-08T13:36:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-grub2-pozvolyayushhie-obojti-uefi-secure-boot"},"modified":"2022-06-08T15:36:43","modified_gmt":"2022-06-08T13:36:43","slug":"uyazvimosti-v-grub2-pozvolyayushhie-obojti-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-grub2-pozvolyayushhie-obojti-uefi-secure-boot","title":{"rendered":"Vulnerabilitetet n\u00eb GRUB2, q\u00eb lejojn\u00eb kalimin e UEFI Secure Boot","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb ngarkuesin GRUB2 jan\u00eb eliminuar 7 dob\u00ebsi q\u00eb lejojn\u00eb kalimin e mekanizmit UEFI Secure Boot dhe fillimin e kodit t\u00eb pa verifikuar, si p\u00ebr shembull, implementimin e malware-it q\u00eb funksionon n\u00eb nivelin e ngarkuesit ose b\u00ebrtham\u00ebs. Gjithashtu, v\u00ebrehet nj\u00eb dob\u00ebsi n\u00eb shimin, e cila gjithashtu lejon kalimin e UEFI Secure Boot. Grupi i dob\u00ebsive mori emrin Boothole 3, n\u00eb t\u00eb nj\u00ebjt\u00ebn m\u00ebnyr\u00eb si problemet e ngjashme q\u00eb jan\u00eb identifikuar m\u00eb par\u00eb n\u00eb ngarkuesin. <\/p>\n
P\u00ebr t\u00eb zgjidhur problemet n\u00eb GRUB2 dhe shim, shp\u00ebrndarjet do t\u00eb ken\u00eb mund\u00ebsin\u00eb t\u00eb p\u00ebrdorin mekanizmin SBAT (UEFI Secure Boot Advanced Targeting), mb\u00ebshtetje p\u00ebr t\u00eb cilin \u00ebsht\u00eb implementuar p\u00ebr GRUB2, shim dhe fwupd. SBAT \u00ebsht\u00eb zhvilluar n\u00eb bashk\u00ebpunim me Microsoft dhe parashikon shtimin e metadatat n\u00eb skedar\u00ebt ekzekutiv\u00eb t\u00eb komponenteve UEFI, t\u00eb cilat p\u00ebrfshijn\u00eb informacion mbi prodhuesin, produktin, komponentin dhe versionin. Metadatat e p\u00ebrmendura n\u00ebnshkruhen me nj\u00eb n\u00ebnshkrim digjital dhe mund t\u00eb p\u00ebrfshihen ve\u00e7mas n\u00eb listat e komponenteve t\u00eb lejuara ose t\u00eb ndaluara p\u00ebr UEFI Secure Boot. <\/p>\n
N\u00eb shumic\u00ebn e shp\u00ebrndarjeve Linux, p\u00ebr ngarkimin e verifikuar n\u00eb m\u00ebnyr\u00ebn UEFI Secure Boot p\u00ebrdoret nj\u00eb shtres\u00eb e vog\u00ebl shim, e cila \u00ebsht\u00eb n\u00ebnshkruar me nj\u00eb n\u00ebnshkrim digjital nga Microsoft. Kjo shtres\u00eb verifikon GRUB2 me certifikat\u00ebn e saj, duke lejuar zhvilluesit e shp\u00ebrndarjeve t\u00eb mos n\u00ebnshkruajn\u00eb \u00e7do p\u00ebrdit\u00ebsim t\u00eb b\u00ebrtham\u00ebs dhe GRUB n\u00eb Microsoft. Dob\u00ebsit\u00eb n\u00eb GRUB2 lejojn\u00eb ekzekutimin e kodit t\u00eb tyre n\u00eb nj\u00eb faz\u00eb pas verifikimit t\u00eb suksessh\u00ebm t\u00eb shim, por para se t\u00eb ngarkohet sistemi operativ, duke nd\u00ebrhyr\u00eb n\u00eb zinxhirin e besimit n\u00eb nj\u00eb m\u00ebnyr\u00eb aktive t\u00eb Secure Boot dhe duke marr\u00eb kontrollin e plot\u00eb mbi procesin e m\u00ebtejsh\u00ebm t\u00eb ngarkimit, p\u00ebrfshir\u00eb ngarkimin e nj\u00eb OS tjet\u00ebr, modifikimin e komponent\u00ebve t\u00eb sistemit operativ dhe kalimin e mbrojtjes Lockdown. <\/p>\n
P\u00ebr t\u00eb zgjidhur problemet n\u00eb ngarkues, shp\u00ebrndarjet do t\u00eb duhet t\u00eb formulojn\u00eb n\u00ebnshkrime t\u00eb reja digjitale t\u00eb brendshme dhe t\u00eb p\u00ebrdit\u00ebsojn\u00eb instaluesit, ngarkuesit, paketat e b\u00ebrtham\u00ebs, firmware-t fwupd dhe shtres\u00ebn shim. Para se t\u00eb implementohej SBAT, p\u00ebrdit\u00ebsimi i list\u00ebs s\u00eb \u00e7ertifikatave t\u00eb revokuara (dbx, Lista e Revokimit UEFI) ishte nj\u00eb kusht i detyruesh\u00ebm p\u00ebr bllokimin e plot\u00eb t\u00eb dob\u00ebsis\u00eb, pasi sulmuesi, pavar\u00ebsisht nga sistemi operativ t\u00eb p\u00ebrdorur, mund t\u00eb p\u00ebrdorte nj\u00eb media ngarkimi me nj\u00eb version t\u00eb vjet\u00ebr t\u00eb dob\u00ebt t\u00eb GRUB2, t\u00eb n\u00ebnshkruar me nj\u00eb n\u00ebnshkrim digjital. <\/p>\n
N\u00eb vend t\u00eb revokimit t\u00eb n\u00ebnshkrimeve, SBAT lejon bllokimin e p\u00ebrdorimit t\u00eb saj p\u00ebr numra specifik versionesh t\u00eb komponent\u00ebve pa pasur nevoj\u00eb t\u00eb revokohen \u00e7el\u00ebsat p\u00ebr Secure Boot. Bllokimi i dob\u00ebsive p\u00ebrmes SBAT nuk k\u00ebrkon p\u00ebrdorimin e list\u00ebs s\u00eb \u00e7ertifikatave t\u00eb revokuara t\u00eb UEFI (dbx), por kryhet n\u00eb nivelin e z\u00ebvend\u00ebsimit t\u00eb \u00e7el\u00ebsit t\u00eb brendsh\u00ebm p\u00ebr formimin e n\u00ebnshkrimeve dhe p\u00ebrdit\u00ebsimin e GRUB2, shim dhe artefakteve t\u00eb tjera ngarkuese q\u00eb ofrohen nga shp\u00ebrndarjet. Aktualisht, mb\u00ebshtetja p\u00ebr SBAT \u00ebsht\u00eb shtuar tashm\u00eb n\u00eb shumic\u00ebn e shp\u00ebrndarjeve t\u00eb njohura Linux. <\/p>\n
Vulnerabilitetet e identifikuara: <\/p>\n
\n
CVE-2021-3696, CVE-2021-3695 - mbushja e buffers n\u00eb heap gjat\u00eb p\u00ebrpunimit t\u00eb imazheve PNG t\u00eb formuara posa\u00e7\u00ebrisht, q\u00eb teoretikisht mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb organizuar ekzekutimin e kodit t\u00eb sulmuesit dhe kalimin e UEFI Secure Boot. V\u00ebrehet se problemi \u00ebsht\u00eb i v\u00ebshtir\u00eb p\u00ebr t'u shfryt\u00ebzuar, pasi krijimi i nj\u00eb eksploiti funksional k\u00ebrkon njohjen e nj\u00eb numri t\u00eb madh faktor\u00ebsh dhe informacionin mbi shp\u00ebrndarjen e memories.\n
CVE-2021-3697 - mbushja n\u00eb fund t\u00eb buffers (buffer underflow) n\u00eb kodin p\u00ebrpunues t\u00eb imazheve JPEG. Shfryt\u00ebzimi i problemit k\u00ebrkon marrjen e informacionit mbi shp\u00ebrndarjen e memories dhe ndodhet n\u00eb nj\u00eb nivel t\u00eb ngjash\u00ebm v\u00ebshtir\u00ebsie si problemi me PNG (CVSS 7.5).\n
CVE-2022-28733 \u2014 te nji\u00e7 shuffle n\u00eb funksionin grub_net_recv_ip4_packets(), i cili lejon t\u00eb ndikosh n\u00eb parametrin rsm->total_len duke d\u00ebrguar nj\u00eb paket\u00eb IP t\u00eb personalizuar. Problemi \u00ebsht\u00eb cil\u00ebsuar si m\u00eb i rrezikshmi nga vulnerabilitetet e paraqitura (CVSS 8.1). N\u00ebse keqfrmimi \u00ebsht\u00eb i suksessh\u00ebm, vulnerabiliteti lejon shkrimin e t\u00eb dh\u00ebnave jasht\u00eb kufijve t\u00eb buferit p\u00ebrmes caktimit t\u00eb nj\u00eb memorjeje t\u00eb qart\u00eb m\u00eb t\u00eb vog\u00ebl se duhej.\n
CVE-2022-28734 \u2014 nj\u00eb p\u00ebrplasje nj\u00eb-byte n\u00eb bufer gjat\u00eb p\u00ebrpunimit t\u00eb titujve HTTP t\u00eb ndar\u00eb. Problemi mund t\u00eb \u00e7oj\u00eb n\u00eb d\u00ebmtimin e metadata-ve t\u00eb GRUB2 (shkruani byte zero menj\u00ebher\u00eb pas fundit t\u00eb buferit) gjat\u00eb analiz\u00ebs s\u00eb k\u00ebrkesave HTTP t\u00eb personalizuara.\n
CVE-2022-28735 \u2014 nj\u00eb problem n\u00eb verifikuesin shim_lock, q\u00eb lejon ngarkimin e skedareve q\u00eb nuk kan\u00eb t\u00eb b\u00ebjn\u00eb me kernelin. Vulnerabiliteti mund t\u00eb p\u00ebrdoret p\u00ebr ngarkimin n\u00eb modin UEFI Secure Boot t\u00eb moduleve t\u00eb kernelit q\u00eb nuk kan\u00eb n\u00ebnshkrim digjital t\u00eb verifikuar ose kodin e pa verifikuar.\n
CVE-2022-28736 \u2014 qasja n\u00eb nj\u00eb zon\u00eb memorie t\u00eb \u00e7liruar m\u00eb par\u00eb n\u00eb funksionin grub_cmd_chainloader() p\u00ebrmes rindezjes s\u00eb komand\u00ebs chainloader, e cila p\u00ebrdoret p\u00ebr ngarkimin e sistemeve operative q\u00eb nuk mb\u00ebshteten n\u00eb GRUB2. Keqfrimi mund t\u00eb \u00e7oj\u00eb n\u00eb ekzekutimin e kodit t\u00eb sulmuesit, n\u00ebse sulmuesi \u00ebsht\u00eb n\u00eb gjendje t\u00eb p\u00ebrcaktoj\u00eb karakteristikat e shp\u00ebrndarjes s\u00eb memorjes n\u00eb GRUB2.\n