N\u00eb shtres\u00ebn Shim, e cila p\u00ebrdoret n\u00eb shumic\u00ebn e distribucioneve Linux p\u00ebr ngarkimin e verifikuar n\u00eb modalitetin UEFI Secure Boot, \u00ebsht\u00eb identifikuar nj\u00eb vulnerabilitet (CVE-2023-40547) q\u00eb mund t\u00eb \u00e7oj\u00eb n\u00eb ekzekutimin e kodit n\u00eb distanc\u00eb dhe anashkalimin e mekanizmit t\u00eb ngarkimit t\u00eb verifikuar UEFI Secure Boot. Nj\u00eb sulmues q\u00eb kontrollon serverin HTTP, t\u00eb cilit i qaset Shim, mund t\u00eb kthej\u00eb nj\u00eb p\u00ebrgjigje t\u00eb formuar n\u00eb m\u00ebnyr\u00eb speciale q\u00eb \u00e7on n\u00eb nj\u00eb shkres\u00eb t\u00eb kontrolluar jasht\u00eb kufirit t\u00eb bllokut p\u00ebr t\u00eb organizuar ekzekutimin e kodit n\u00eb nj\u00eb faz\u00eb t\u00eb hershme t\u00eb ngarkimit. <\/p>\n
\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043a\u043e\u0434\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 \u043f\u043e HTTP, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u0445 \u043e\u0442\u0432\u0435\u0442\u043e\u0432, \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0451\u043d\u043d\u044b\u0445 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c, \u043a \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043e\u0431\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f shim. \u0420\u0435\u0436\u0438\u043c HTTPBoot \u0432 Shim \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0441 2016 \u0433\u043e\u0434\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043f\u043e \u0441\u0435\u0442\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b HTTP \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u0430 c \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u043e\u043c, \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u043c \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c \u044d\u0442\u0430\u043f\u0435. Shim \u043f\u0440\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u0444\u0430\u0439\u043b\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 HTTP \u0432\u044b\u0434\u0435\u043b\u044f\u0435\u0442 \u0431\u0443\u0444\u0435\u0440 \u0434\u043b\u044f \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u043d\u0435 \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u043c\u0435\u0440 \u0434\u0430\u043d\u043d\u044b\u0445, \u0430 \u0440\u0430\u0437\u043c\u0435\u0440, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0439 \u0432 HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0435 «Content-Lenght». \u0421\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u0432\u0435\u0440\u043d\u0443\u0432 \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0435 Content-Lenght \u043c\u0435\u043d\u044c\u0448\u0435\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435, \u043c\u043e\u0436\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0445\u0432\u043e\u0441\u0442\u0430 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u044c \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0435\u0439 \u0431\u0443\u0444\u0435\u0440\u0430. <\/p>\n
Shim \u00ebsht\u00eb i verifikuar me nj\u00eb n\u00ebnshkrim digjital nga Microsoft dhe verifikon GRUB2 me nj\u00eb certifikat\u00eb t\u00eb vet\u00eb, e cila u lejon zhvilluesve t\u00eb distribucioneve t\u00eb mos e n\u00ebnshkruajn\u00eb \u00e7do p\u00ebrdit\u00ebsim t\u00eb kernelit dhe GRUB te Microsoft. Vulnerabiliteti n\u00eb Shim ofron mund\u00ebsin\u00eb e nd\u00ebrhyrjes n\u00eb zinxhirin e besimit gjat\u00eb funksionimit t\u00eb Secure Boot dhe marrjen e kontrollit t\u00eb plot\u00eb mbi procesin e ngarkimit, p\u00ebr shembull, p\u00ebr t\u00eb ngarkuar nj\u00eb OS tjet\u00ebr, p\u00ebr t\u00eb modifikuar komponent\u00ebt e sistemit operativ dhe p\u00ebr t\u00eb anashkaluar mbrojtjen Lockdown. <\/p>\n
Vulnerabiliteti \u00ebsht\u00eb eliminuar n\u00eb versionin Shim 15.8, por p\u00ebr t\u00eb bllokuar plot\u00ebsisht sulmin p\u00ebrmes Shim k\u00ebrkohet n\u00ebnshkrimi i versionit t\u00eb ri nga Microsoft dhe implementimi i tij n\u00eb distribucionet. Statusi i rregullimit t\u00eb vulnerabilitetit n\u00eb distribucionet mund t\u00eb vler\u00ebsohet n\u00eb k\u00ebto faqe: Debian, Ubuntu, SUSE, RHEL, Fedora. Problemi q\u00ebndron n\u00eb faktin se pa t\u00ebrheqjen e n\u00ebnshkrimit p\u00ebr versionin e vjet\u00ebr, rregullimi \u00ebsht\u00eb i pafrytsh\u00ebm, pasi sulmuesi mund t\u00eb p\u00ebrdor\u00eb nj\u00eb media ngarkimi me versionin e cenuesh\u00ebm Shim p\u00ebr t\u00eb kompromituar UEFI Secure Boot. Por t\u00ebrheqja e n\u00ebnshkrimit do t\u00eb \u00e7onte n\u00eb pamund\u00ebsin\u00eb e ngarkimit t\u00eb verifikuar t\u00eb distribucioneve q\u00eb vazhdojn\u00eb t\u00eb p\u00ebrdorin versionin e vjet\u00ebr t\u00eb Shim. <\/p>\n
P\u00ebr t\u00eb bllokuar vulnerabilitetin pa t\u00ebrheqjen e n\u00ebnshkrimit dixhital, shp\u00ebrndarjet mund t\u00eb p\u00ebrdorin mekanizmin SBAT (UEFI Secure Boot Advanced Targeting), mb\u00ebshtetje e t\u00eb cilit \u00ebsht\u00eb zbatuar p\u00ebr GRUB2, shim dhe fwupd n\u00eb shumic\u00ebn e shp\u00ebrndarjeve t\u00eb njohura Linux. SBAT-u \u00ebsht\u00eb zhvilluar n\u00eb bashk\u00ebpunim me Microsoft dhe n\u00ebnkupton shtimin n\u00eb skedar\u00ebt ekzekutiv\u00eb t\u00eb komponent\u00ebve UEFI t\u00eb metadatat shtes\u00eb, t\u00eb cilat p\u00ebrfshijn\u00eb informacionin mbi prodhuesin, produktin, komponentin dhe versionin. Metaet e p\u00ebrmendura n\u00ebnshkruhen me nj\u00eb n\u00ebnshkrim dixhital dhe mund t\u00eb p\u00ebrfshihen ve\u00e7mas n\u00eb listat e lejuara ose t\u00eb ndaluara t\u00eb komponent\u00ebve p\u00ebr UEFI Secure Boot. <\/p>\n
SBAT lejon bllokimin e p\u00ebrdorimit t\u00eb n\u00ebnshkrimit digjital p\u00ebr numra t\u00eb ve\u00e7ant\u00eb versionesh t\u00eb komponent\u00ebve pa pasur nevoj\u00eb p\u00ebr t\u00ebrheqjen e \u00e7el\u00ebsave p\u00ebr Secure Boot. Bllokimi i vulnerabiliteteve p\u00ebrmes SBAT nuk k\u00ebrkon p\u00ebrdorimin e list\u00ebs s\u00eb n\u00ebnshkruar t\u00eb certifikatave t\u00eb t\u00ebrhequra UEFI (dbx), por b\u00ebhet n\u00eb nivelin e z\u00ebvend\u00ebsimit t\u00eb \u00e7el\u00ebsit t\u00eb brendsh\u00ebm p\u00ebr formimin e n\u00ebnshkrimeve dhe p\u00ebrdit\u00ebsimin e GRUB2, shim dhe artefakteve t\u00eb tjera t\u00eb ngarkes\u00ebs t\u00eb ofruara nga distribucioni. <\/p>\n
P\u00ebrve\u00e7 vulnerabilitetit t\u00eb trajtuar n\u00eb Shim 15.8, jan\u00eb rregulluar gjithashtu disa \u00e7\u00ebshtje m\u00eb pak t\u00eb rrezikshme, t\u00eb shfryt\u00ebzuara lokal: <\/p>\n