{"id":99320,"date":"2021-03-03T16:22:39","date_gmt":"2021-03-03T14:22:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/trudnoustranimye-uyazvimosti-v-grub2-pozvolyayushhie-obojti-uefi-secure-boot"},"modified":"2021-03-03T16:22:39","modified_gmt":"2021-03-03T14:22:39","slug":"trudnoustranimye-uyazvimosti-v-grub2-pozvolyayushhie-obojti-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/trudnoustranimye-uyazvimosti-v-grub2-pozvolyayushhie-obojti-uefi-secure-boot","title":{"rendered":"Dob\u00ebsi t\u00eb v\u00ebshtira p\u00ebr t'u eliminuar n\u00eb GRUB2 q\u00eb lejojn\u00eb kalimin e UEFI Secure Boot","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
\u00cbsht\u00eb zbuluar informacioni p\u00ebr 8 dob\u00ebsi n\u00eb ngarkuesin GRUB2, q\u00eb lejojn\u00eb anashkalimin e mekanizmit UEFI Secure Boot dhe realizimin e ekzekutimit t\u00eb kodit t\u00eb pa-verifikuar, si p.sh., futjen e malware-it q\u00eb operon n\u00eb nivelin e ngarkuesit ose t\u00eb b\u00ebrthamor\u00ebs. <\/p>\n
Kujtojm\u00eb se n\u00eb shumic\u00ebn e shp\u00ebrndarjeve Linux, p\u00ebr ngarkimin e verifikuar n\u00eb modin UEFI Secure Boot p\u00ebrdoret nj\u00eb nd\u00ebrfaqe e vog\u00ebl shim, e cila \u00ebsht\u00eb e \u00e7ertifikuar me n\u00ebnshkrimin digjital t\u00eb Microsoft. Kjo nd\u00ebrfaqe verifikon GRUB2 me certifikat\u00ebn e saj, e cila lejon zhvilluesit e shp\u00ebrndarjeve t\u00eb mos e \u00e7ertifikojn\u00eb \u00e7do p\u00ebrdit\u00ebsim t\u00eb b\u00ebrtham\u00ebs dhe GRUB n\u00eb Microsoft. Dob\u00ebsit\u00eb n\u00eb GRUB2 lejojn\u00eb ekzekutimin e kodit t\u00eb tij pas verifikimit t\u00eb suksessh\u00ebm t\u00eb shim, por para ngarkimit t\u00eb sistemit operativ, duke u infiltruar n\u00eb zinxhirin e besueshm\u00ebris\u00eb n\u00eb m\u00ebnyr\u00eb aktive t\u00eb Secure Boot dhe duke marr\u00eb kontroll t\u00eb plot\u00eb mbi procesin e ngarkimit, p\u00ebrfshir\u00eb ngarkimin e nj\u00eb sistemi tjet\u00ebr operativ, modifikimin e komponenteve t\u00eb sistemit operativ dhe anashkalimin e mbrojtjes Lockdown. <\/p>\n
Si n\u00eb rastin e vulnerabilitetit BootHole t\u00eb vitit t\u00eb kaluar, thjesht p\u00ebrdit\u00ebsimi i ngarkuesit nuk \u00ebsht\u00eb i mjaftuesh\u00ebm p\u00ebr t\u00eb bllokuar problemin, pasi sulmuesi, pavar\u00ebsisht nga sistemi operativ t\u00eb p\u00ebrdorur, mund t\u00eb p\u00ebrdor\u00eb nj\u00eb medium ngarkues me nj\u00eb version t\u00eb vjet\u00ebr t\u00eb vulnerab\u00ebl t\u00eb GRUB2, t\u00eb verifikuar me nj\u00eb n\u00ebnshkrim digjital, p\u00ebr t\u00eb komprometuar UEFI Secure Boot. Problemi zgjidhet vet\u00ebm me p\u00ebrdit\u00ebsimin e list\u00ebs s\u00eb certifikatave t\u00eb revokuara (dbx, UEFI Revocation List), por n\u00eb k\u00ebt\u00eb rast do t\u00eb humbas\u00ebsh mund\u00ebsin\u00eb e p\u00ebrdorimit t\u00eb mediave t\u00eb vjetra instalues c Linux. <\/p>\n
N\u00eb sistemet me firmware n\u00eb t\u00eb cilat \u00ebsht\u00eb p\u00ebrdit\u00ebsuar lista e certifikatave t\u00eb t\u00ebrhequra, n\u00eb modalitetin UEFI Secure Boot do t\u00eb jet\u00eb e mundur t\u00eb ngarkohet vet\u00ebm versione t\u00eb p\u00ebrdit\u00ebsuara t\u00eb distribucioneve Linux. Distribucionet do t\u00eb ken\u00eb nevoj\u00eb t\u00eb p\u00ebrdit\u00ebsojn\u00eb instaluesit, ngarkuesit, paketat e b\u00ebrtham\u00ebs, firmware fwupd dhe shtesat shim, duke gjeneruar p\u00ebr to n\u00ebnshkrime dixhitale t\u00eb reja. P\u00ebrdoruesit duhet t\u00eb p\u00ebrdit\u00ebsojn\u00eb imazhet instalues dhe mediat e tjera t\u00eb ngarkimit, si dhe t\u00eb ngarkojn\u00eb list\u00ebn e certifikatave t\u00eb t\u00ebrhequra (dbx) n\u00eb firmware UEFI. Deri n\u00eb p\u00ebrdit\u00ebsimin e dbx n\u00eb UEFI, sistemi mbetet i pambrojtur pavar\u00ebsisht nga instalimi i p\u00ebrdit\u00ebsimeve n\u00eb OS. Statusi i rregullimit t\u00eb dob\u00ebsive mund t\u00eb vler\u00ebsohet n\u00eb k\u00ebto faqe: Ubuntu, SUSE, RHEL, Debian. <\/p>\n
P\u00ebr t\u00eb zgjidhur problemet q\u00eb lindin nga shp\u00ebrndarja e certifikatave t\u00eb t\u00ebrhequra, n\u00eb t\u00eb ardhmen planifikohet p\u00ebrdorimi i mekanizmit SBAT (UEFI Secure Boot Advanced Targeting), mb\u00ebshtetje p\u00ebr t\u00eb cilin \u00ebsht\u00eb implementuar p\u00ebr GRUB2, shim dhe fwupd, dhe duke filluar nga p\u00ebrdit\u00ebsimet e ardhshme do t\u00eb p\u00ebrdoret n\u00eb vend t\u00eb funksionalitetit t\u00eb ofruar nga paketa dbxtool. SBAT \u00ebsht\u00eb zhvilluar n\u00eb bashk\u00ebpunim me Microsoft dhe p\u00ebrfshin shtimin e t\u00eb dh\u00ebnave t\u00eb reja meta n\u00eb skedar\u00ebt ekzekutiv\u00eb t\u00eb p\u00ebrb\u00ebr\u00ebsve UEFI, t\u00eb cilat p\u00ebrmbajn\u00eb informacion mbi prodhuesin, produktin, p\u00ebrb\u00ebr\u00ebsin dhe versionin. T\u00eb dh\u00ebnat e p\u00ebrmendura jan\u00eb t\u00eb n\u00ebnshkruara me nj\u00eb n\u00ebnshkrim digital dhe mund t\u00eb p\u00ebrfshihen gjithashtu n\u00eb listat e p\u00ebrb\u00ebr\u00ebsve t\u00eb lejuar ose t\u00eb ndaluar p\u00ebr UEFI Secure Boot. K\u00ebshtu, SBAT do t\u00eb lejoj\u00eb manipulimin e numrave t\u00eb versioneve t\u00eb p\u00ebrb\u00ebr\u00ebsve n\u00eb rast t\u00eb t\u00ebrheqjeve, pa pasur nevoj\u00eb p\u00ebr rip\u00ebrpunimin e \u00e7el\u00ebsave p\u00ebr Secure Boot dhe pa formimin e n\u00ebnshkrimeve t\u00eb reja p\u00ebr b\u00ebrtham\u00ebn, shim, grub2 dhe fwupd. <\/p>\n
Vulnerabilitetet e identifikuara: <\/p>\n
\n
CVE-2020-14372 — me komand\u00ebn acpi n\u00eb GRUB2, nj\u00eb p\u00ebrdorues me privilegje n\u00eb sistemin lokal mund t\u00eb ngarkoj\u00eb tabela ACPI t\u00eb modifikuara, duke vendosur SSDT (Secondary System Description Table) n\u00eb katalogun \/boot\/efi dhe duke ndryshuar cil\u00ebsimet n\u00eb grub.cfg. Pavar\u00ebsisht nga aktiviteti i m\u00ebnyr\u00ebs Secure Boot, SSDT i propozuar do t\u00eb ekzekutohet nga b\u00ebrthama dhe mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb \u00e7aktivizuar mbrojtjen LockDown, e cila pengon rrug\u00ebt p\u00ebr t\u00eb shkuar p\u00ebrtej UEFI Secure Boot. Si rezultat, sulmuesi mund t\u00eb arrij\u00eb t\u00eb ngarkoj\u00eb modul t\u00eb tij t\u00eb b\u00ebrtham\u00ebs ose t\u00eb ekzekutoj\u00eb kod p\u00ebrmes mekanizmit kexec, pa verifikimin e n\u00ebnshkrimit digjital.\n
CVE-2020-25632 — aksesi n\u00eb nj\u00eb zon\u00eb t\u00eb \u00e7liruar tashm\u00eb t\u00eb memories (use-after-free) n\u00eb implementimin e komand\u00ebs rmmod, e cila shfaqet gjat\u00eb p\u00ebrpjekjes p\u00ebr t\u00eb shkarkuar \u00e7do modul pa marr\u00eb parasysh var\u00ebsit\u00eb e lidhura me t\u00eb. Kjo e ndjeshme nuk p\u00ebrjashton krijimin e nj\u00eb eksploit q\u00eb mund t\u00eb \u00e7oj\u00eb n\u00eb ekzekutimin e kodit duke anashkaluar verifikimin e Secure Boot.\n
CVE-2020-25647 \u2014 nj\u00eb sh\u00ebnim p\u00ebr tejkalimin e kufijve t\u00eb tamponit n\u00eb funksionin grub_usb_device_initialize(), i thirrur gjat\u00eb inicializimit t\u00eb pajisjeve USB. Problemi mund t\u00eb shfryt\u00ebzohet p\u00ebrmes lidhjes s\u00eb nj\u00eb pajisjeje USB t\u00eb p\u00ebrgatitur posa\u00e7\u00ebrisht, e cila ofron parametra, t\u00eb cil\u00ebsit\u00eb e s\u00eb cil\u00ebs nuk p\u00ebrputhen me madh\u00ebsin\u00eb e tamponit t\u00eb ndar\u00eb p\u00ebr strukturat USB. Sulmuesi mund t\u00eb arrij\u00eb ekzekutimin e kodit, q\u00eb nuk verifikohet n\u00eb Secure Boot, p\u00ebrmes manipulimeve me pajisjet USB.\n
CVE-2020-27749 \u2014 nj\u00eb tejkalim i tamponit n\u00eb funksionin grub_parser_split_cmdline(), i cili mund t\u00eb shkaktohet nga p\u00ebrcaktimi n\u00eb komand\u00ebn GRUB2 t\u00eb variablave me nj\u00eb madh\u00ebsi m\u00eb t\u00eb madhe se 1 KB. Vulnerabiliteti lejon ekzekutimin e kodit duke anashkaluar Secure Boot.\n
CVE-2020-27779 \u2014 komand\u00eb cutmem i jep mund\u00ebsi nj\u00eb sulmuesi t\u00eb fshij\u00eb nj\u00eb gam\u00eb adresash nga memoria p\u00ebr t\u00eb anashkaluar Secure Boot.\n
CVE-2021-3418 \u2014 ndryshimet n\u00eb shim_lock krijuan nj\u00eb vektor t\u00eb ri p\u00ebr shfryt\u00ebzimin e vulgurit t\u00eb vitit t\u00eb kaluar CVE-2020-15705. Gjat\u00eb vendosjes n\u00eb dbx t\u00eb certifikat\u00ebs, e cila p\u00ebrdoret p\u00ebr n\u00ebnshkrimin e GRUB2, GRUB2 lejonte ngarkimin e \u00e7do b\u00ebrthame direkt pa verifikimin e n\u00ebnshkrimit.\n
CVE-2021-20225 \u2014 mund\u00ebsia e shkrimit t\u00eb t\u00eb dh\u00ebnave jasht\u00eb kufijve t\u00eb tamponit gjat\u00eb ekzekutimit t\u00eb komandave me nj\u00eb num\u00ebr shum\u00eb t\u00eb madh opsionesh.\n
CVE-2021-20233 — mund\u00ebsia p\u00ebr t\u00eb shkruar t\u00eb dh\u00ebna jasht\u00eb bufrit p\u00ebr shkak t\u00eb llogaritjes s\u00eb gabuar t\u00eb madh\u00ebsis\u00eb s\u00eb bufrit gjat\u00eb p\u00ebrdorimit t\u00eb thonj\u00ebve. Gjat\u00eb llogaritjes s\u00eb madh\u00ebsis\u00eb supozohej se p\u00ebr shkak t\u00eb sh\u00ebnj\u00ebs s\u00eb vetme nevojiten tre simbole, kur n\u00eb t\u00eb v\u00ebrtet\u00eb nevojiten kat\u00ebr. <\/ul>\n