N\u00eb shtres\u00ebn Shim, e p\u00ebrdorur n\u00eb shumic\u00ebn e shp\u00ebrndarjeve Linux p\u00ebr nisje t\u00eb verifikuar n\u00eb modalitetin UEFI Secure Boot, \u00ebsht\u00eb zbuluar nj\u00eb cenueshm\u00ebri (CVE-2023-40547) q\u00eb mund t\u00eb \u00e7oj\u00eb n\u00eb ekzekutim t\u00eb kodit n\u00eb distanc\u00eb dhe anashkalim t\u00eb mekanizmit t\u00eb nisjes s\u00eb verifikuar UEFI Secure Boot. Nj\u00eb sulmues q\u00eb kontrollon serverin HTTP te i cili lidhet Shim mund t\u00eb kthej\u00eb nj\u00eb p\u00ebrgjigje t\u00eb formuar posa\u00e7\u00ebrisht, e cila shkakton nj\u00eb shkrim t\u00eb kontrolluar jasht\u00eb kufijve t\u00eb buffer-it, duke mund\u00ebsuar ekzekutimin e kodit n\u00eb faz\u00ebn e hershme t\u00eb nisjes. <\/p>\n
Vulnerabiliteti shkaktohet nga nj\u00eb gabim n\u00eb kodin e ngarkimit t\u00eb skedar\u00ebve p\u00ebrmes HTTP, i cili manifestohet gjat\u00eb p\u00ebrpunimit t\u00eb p\u00ebrgjigjeve t\u00eb pavlefshme q\u00eb kthehen nga serveri HTTP, t\u00eb cilit i drejtohet shim. Modaliteti HTTPBoot n\u00eb Shim \u00ebsht\u00eb mb\u00ebshtetur q\u00eb nga viti 2016 dhe lejon organizimin e ngarkimit n\u00eb rrjet, duke p\u00ebrdorur protokollin HTTP p\u00ebr t\u00eb nxjerr\u00eb skedarin me ngarkuesin, i cili thirret n\u00eb etap\u00ebn e ardhshme. Shim, gjat\u00eb ngarkimit t\u00eb skedar\u00ebve p\u00ebrmes HTTP, ndan nj\u00eb tampon p\u00ebr t\u00eb dh\u00ebnat q\u00eb pranohet, duke marr\u00eb parasysh jo madh\u00ebsin\u00eb e v\u00ebrtet\u00eb t\u00eb t\u00eb dh\u00ebnave, por madh\u00ebsin\u00eb q\u00eb \u00ebsht\u00eb e specifikuar n\u00eb titullin HTTP 'Content-Length'. Prandaj, duke kthyer nj\u00eb vler\u00eb m\u00eb t\u00eb vog\u00ebl n\u00eb titullin Content-Length, \u00ebsht\u00eb e mundur t\u00eb arrihet shkrimi i bishtit t\u00eb k\u00ebrkes\u00ebs n\u00eb memorie jasht\u00eb tamponit. <\/p>\n
Shim \u00ebsht\u00eb i n\u00ebnshkruar dixhitalisht nga Microsoft dhe verifikon GRUB2 me certifikat\u00ebn e vet, \u00e7ka u lejon zhvilluesve t\u00eb shp\u00ebrndarjeve t\u00eb mos certifikojn\u00eb \u00e7do p\u00ebrdit\u00ebsim t\u00eb kernel-it dhe GRUB te Microsoft. Cenueshm\u00ebria n\u00eb Shim b\u00ebn t\u00eb mundur nd\u00ebrhyrjen n\u00eb zinxhirin e besimit kur modaliteti Secure Boot \u00ebsht\u00eb aktiv dhe marrjen e kontrollit t\u00eb plot\u00eb mbi procesin e m\u00ebtejsh\u00ebm t\u00eb nisjes, p\u00ebr shembull p\u00ebr t\u00eb ngarkuar nj\u00eb OS tjet\u00ebr, p\u00ebr t\u00eb modifikuar komponent\u00ebt e sistemit operativ dhe p\u00ebr t\u00eb anashkaluar mbrojtjen Lockdown. <\/p>\n
Cenueshm\u00ebria \u00ebsht\u00eb korrigjuar n\u00eb versionin Shim 15.8, por p\u00ebr ta bllokuar plot\u00ebsisht sulmin p\u00ebrmes Shim k\u00ebrkohet q\u00eb versioni i ri t\u00eb certifikohet nga Microsoft dhe t\u00eb integrohet n\u00eb shp\u00ebrndarje. Statusi i korrigjimit t\u00eb cenueshm\u00ebris\u00eb n\u00eb shp\u00ebrndarje mund t\u00eb kontrollohet n\u00eb k\u00ebto faqe: Debian, Ubuntu, SUSE, RHEL, Fedora. Problemi \u00ebsht\u00eb se pa revokimin e n\u00ebnshkrimit t\u00eb versionit t\u00eb vjet\u00ebr, korrigjimi \u00ebsht\u00eb i pavlefsh\u00ebm, pasi nj\u00eb sulmues mund t\u00eb p\u00ebrdor\u00eb nj\u00eb media boot me nj\u00eb version t\u00eb cenuesh\u00ebm t\u00eb Shim p\u00ebr t\u00eb komprometuar UEFI Secure Boot. Por revokimi i n\u00ebnshkrimit do t\u00eb b\u00ebj\u00eb t\u00eb pamundur nisjen e verifikuar p\u00ebr shp\u00ebrndarjet q\u00eb vazhdojn\u00eb t\u00eb p\u00ebrdorin versionin e vjet\u00ebr t\u00eb Shim. <\/p>\n
P\u00ebr t\u00eb bllokuar vulnerabilitetin pa anulluar n\u00ebnshkrimin digjital, shp\u00ebrndarjet mund t\u00eb p\u00ebrdorin mekanizmin SBAT (UEFI Secure Boot Advanced Targeting), mb\u00ebshtetje e t\u00eb cilit \u00ebsht\u00eb realizuar p\u00ebr GRUB2, shim dhe fwupd n\u00eb shumic\u00ebn e shp\u00ebrndarjeve t\u00eb njohura Linux. SBAT \u00ebsht\u00eb zhvilluar n\u00eb bashk\u00ebpunim me Microsoft dhe parashikon shtimin e metadatas n\u00eb skedar\u00ebt ekzekutiv\u00eb t\u00eb komponenteve UEFI, q\u00eb p\u00ebrfshin informacion mbi prodhuesin, produktin, komponentin dhe versionin. K\u00ebto metadata n\u00ebnshkruhen me nj\u00eb n\u00ebnshkrim digjital dhe mund t\u00eb p\u00ebrfshihen ve\u00e7mas n\u00eb listat e miratuara ose t\u00eb ndaluara p\u00ebr UEFI Secure Boot. <\/p>\n
SBAT mund\u00ebson bllokimin e p\u00ebrdorimit t\u00eb n\u00ebnshkrimit dixhital p\u00ebr versione t\u00eb caktuara t\u00eb komponent\u00ebve, pa qen\u00eb nevoja t\u00eb revokohen \u00e7el\u00ebsat p\u00ebr Secure Boot. Zbutja e dob\u00ebsive p\u00ebrmes SBAT nuk k\u00ebrkon p\u00ebrdorimin e list\u00ebs s\u00eb certifikatave t\u00eb revokuara UEFI (dbx), por kryhet n\u00eb nivelin e z\u00ebvend\u00ebsimit t\u00eb \u00e7el\u00ebsit t\u00eb brendsh\u00ebm p\u00ebr krijimin e n\u00ebnshkrimeve dhe p\u00ebrdit\u00ebsimit t\u00eb GRUB2, shim dhe artefakteve t\u00eb tjera t\u00eb nisjes q\u00eb shp\u00ebrndahen me distribucionet. <\/p>\n
P\u00ebrve\u00e7 dob\u00ebsis\u00eb s\u00eb p\u00ebrmendur, n\u00eb Shim 15.8 jan\u00eb korrigjuar edhe disa probleme t\u00eb tjera m\u00eb pak kritike q\u00eb mund t\u00eb shfryt\u00ebzohen lokalisht: <\/p>\n