{"id":119554,"date":"2024-08-21T09:43:00","date_gmt":"2024-08-21T07:43:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/oshibka-v-obnovlenii-k-windows-blokirovala-zagruzku-linux-pri-ispolzovanii-uefi-secure-boot"},"modified":"2024-08-21T09:43:00","modified_gmt":"2024-08-21T07:43:00","slug":"oshibka-v-obnovlenii-k-windows-blokirovala-zagruzku-linux-pri-ispolzovanii-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/oshibka-v-obnovlenii-k-windows-blokirovala-zagruzku-linux-pri-ispolzovanii-uefi-secure-boot","title":{"rendered":"Nj\u00eb gabim n\u00eb p\u00ebrdit\u00ebsimin p\u00ebr Windows bllokoi ngarkimin e Linux-it kur p\u00ebrdorej UEFI Secure Boot","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb azhurnimin e liruar t\u00eb mart\u00ebn nga Microsoft p\u00ebr sistemin operativ Windows, u zbulua nj\u00eb problem q\u00eb \u00e7on n\u00eb pamund\u00ebsin\u00eb e ngarkes\u00ebs s\u00eb sistemeve Linux t\u00eb instaluara n\u00eb t\u00eb nj\u00ebjtin kompjuter paralel me Windows. Shkaku i problemeve \u00ebsht\u00eb nj\u00eb korrigjim q\u00eb ka p\u00ebr q\u00ebllim t\u00eb eliminoj\u00eb nj\u00eb vulnerabilitet t\u00eb vjet\u00ebr (CVE-2022-2601) n\u00eb ngarkuesin GRUB, i rregulluar n\u00eb vitin 2022. Microsoft ende nuk ka publikuar nj\u00eb deklarat\u00eb lidhur me d\u00ebshtimin e ndodhur dhe nuk e ka komentuar at\u00eb. <\/p>\n
N\u00eb sh\u00ebnimin lidhur me ndryshimin u tha se korrigjimi, i cili siguron implementimin e politik\u00ebs s\u00eb re SBAT (UEFI Secure Boot Advanced Targeting), do t\u00eb aplikohen p\u00ebr sistemet q\u00eb p\u00ebrdorin vet\u00ebm Windows dhe nuk do t\u00eb prekin konfigurimet me ngarkes\u00eb t\u00eb dyfisht\u00eb (ndryshimi ndaloi p\u00ebrdorimin e imazheve t\u00eb ngarkes\u00ebs me GRUB t\u00eb vjet\u00ebr p\u00ebr t\u00eb anashkaluar Secure Boot n\u00eb sistemet q\u00eb kan\u00eb vet\u00ebm Windows t\u00eb instaluar). Gjithashtu u tha se ndryshimi mund t\u00eb sjell\u00eb probleme me ngarkimin e imazheve iso t\u00eb sistemeve t\u00eb vjetra, t\u00eb cilat vijn\u00eb me nj\u00eb version t\u00eb ndjesh\u00ebm t\u00eb GRUB. N\u00eb praktik\u00eb, problemet u manifestuan gjithashtu dhe te p\u00ebrdoruesit e sistemeve me ngarkes\u00eb t\u00eb dyfisht\u00eb, q\u00eb p\u00ebrdorin shp\u00ebrndarjet e reja t\u00eb Linux, si Ubuntu 24.04 dhe Debian 12.6, ku vulnerabiliteti n\u00eb GRUB \u00ebsht\u00eb rregulluar prej koh\u00ebsh. <\/p>\n
Problemi ndodh kur ngarkimi ndalet me mesazhin \"Verifying shim SBAT data failed: Security Policy Violation. Di\u00e7ka ka shkuar keq: SBAT self-check failed: Security Policy Violation\". Si nj\u00eb m\u00ebnyr\u00eb p\u00ebr t\u00eb rikthyer funksionimin, rekomandohet t\u00eb hiqni t\u00eb dh\u00ebnat SBAT t\u00eb instaluara n\u00eb UEFI, p\u00ebr t\u00eb cilat mund t\u00eb \u00e7aktivizoni Secure Boot n\u00eb BIOS, ngarkoni nj\u00eb distribucion t\u00eb ri Linux q\u00eb mb\u00ebshtet UEFI Secure Boot, si Ubuntu, dhe ekzekutoni n\u00eb konsol\u00ebn komand\u00ebn \"mokutil --set-sbat-policy delete\", pas s\u00eb cil\u00ebs p\u00ebrs\u00ebri ngarkoni distribucionin Linux p\u00ebr t\u00eb instaluar politik\u00ebn e duhur SBAT. Pas k\u00ebsaj, mund t\u00eb ktheheni n\u00eb modalitetin Secure Boot n\u00eb BIOS. <\/p>\n
Mekanizmi SBAT u zhvillua nga Red Hat n\u00eb bashk\u00ebpunim me Microsoft p\u00ebr t\u00eb bllokuar vulnerabilitetet n\u00eb ngarkuesin GRUB dhe n\u00eb shtres\u00ebn shim pa t\u00ebrheqjen e n\u00ebnshkrimit digjital. SBAT parashikon shtimin n\u00eb skedar\u00ebt ekzekutiv\u00eb t\u00eb komponent\u00ebve UEFI t\u00eb meta-dh\u00ebnave shtes\u00eb, t\u00eb cilat p\u00ebrfshijn\u00eb informacion rreth prodhuesit, produktit, komponentit dhe versionit. K\u00ebto meta-dh\u00ebna n\u00ebnshkruhen me nj\u00eb n\u00ebnshkrim digjital dhe mund t\u00eb p\u00ebrfshihen n\u00eb lista t\u00eb lejuara ose t\u00eb ndaluara t\u00eb komponent\u00ebve p\u00ebr UEFI Secure Boot. SBAT lejon bllokimin e p\u00ebrdorimit t\u00eb n\u00ebnshkrimit digjital p\u00ebr numra t\u00eb ve\u00e7uar versioni t\u00eb komponenteve, pa pasur nevoj\u00eb p\u00ebr t\u00eb t\u00ebrhequr \u00e7el\u00ebsat p\u00ebr Secure Boot. <\/p>\n
Bllokimi i vulnerabiliteteve p\u00ebrmes SBAT nuk k\u00ebrkon p\u00ebrdorimin e list\u00ebs s\u00eb \u00e7ertifikatave t\u00eb t\u00ebrhequra UEFI (dbx), por kryhet n\u00eb nivelin e z\u00ebvend\u00ebsimit t\u00eb \u00e7el\u00ebsit t\u00eb brendsh\u00ebm p\u00ebr formimin e n\u00ebnshkrimeve dhe p\u00ebrdit\u00ebsimin e GRUB2, shim dhe artefakteve t\u00eb tjera t\u00eb ngarkes\u00ebs t\u00eb shp\u00ebrndara. Para implementimit t\u00eb SBAT, p\u00ebrdit\u00ebsimi i list\u00ebs s\u00eb \u00e7ertifikatave t\u00eb t\u00ebrhequra (dbx, UEFI Revocation List) ishte nj\u00eb kusht i domosdosh\u00ebm p\u00ebr bllokimin e plot\u00eb t\u00eb vulnerabilitetit, pasi sulmuesi, pavar\u00ebsisht nga sistemi operativ t\u00eb p\u00ebrdorur, mund t\u00eb p\u00ebrdorte nj\u00eb mbajt\u00ebs ngarkese me nj\u00eb version t\u00eb vjet\u00ebr t\u00eb GRUB2, t\u00eb n\u00ebnshkruar me n\u00ebnshkrim digjital p\u00ebr t\u00eb komprometuar UEFI Secure Boot. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"