{"id":99320,"date":"2021-03-03T16:22:39","date_gmt":"2021-03-03T14:22:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/trudnoustranimye-uyazvimosti-v-grub2-pozvolyayushhie-obojti-uefi-secure-boot"},"modified":"2021-03-03T16:22:39","modified_gmt":"2021-03-03T14:22:39","slug":"trudnoustranimye-uyazvimosti-v-grub2-pozvolyayushhie-obojti-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/trudnoustranimye-uyazvimosti-v-grub2-pozvolyayushhie-obojti-uefi-secure-boot","title":{"rendered":"Vulnerabilitetet e pakorrigjueshme n\u00eb GRUB2, q\u00eb lejojn\u00eb kalimin e UEFI Secure Boot","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Informacioni mbi 8 vulnerabilitete n\u00eb ngarkuesin GRUB2, t\u00eb cilat lejojn\u00eb kalimin e mekanizmit UEFI Secure Boot dhe realizimin e ekzekutimit t\u00eb kodit t\u00eb paevituar, p\u00ebr shembull, p\u00ebr t\u00eb futur malware q\u00eb operon n\u00eb nivelin e ngarkuesit ose b\u00ebrthames. <\/p>\n
Kujtojm\u00eb se n\u00eb shumic\u00ebn e distribucioneve Linux p\u00ebr ngarkim t\u00eb verifikuar n\u00eb modalitetin UEFI Secure Boot p\u00ebrdoret nj\u00eb shtres\u00eb e vog\u00ebl shim, e verifikuar me n\u00ebnshkrim digjital nga Microsoft. Kjo shtres\u00eb verifikon GRUB2 me certifikat\u00ebn e saj, \u00e7ka lejon zhvilluesit e distribuenteve t\u00eb mos e n\u00ebnshkruajn\u00eb \u00e7do azhurnim t\u00eb b\u00ebrtham\u00ebs dhe GRUB nga Microsoft. Vulnerabilitetet n\u00eb GRUB2 lejojn\u00eb realizimin e kodit t\u00eb tyre n\u00eb faz\u00ebn pas verifikimit t\u00eb suksessh\u00ebm t\u00eb shim, por para ngarkimit t\u00eb sistemit operativ, duke u infiltruar n\u00eb zinxhirin e besueshm\u00ebris\u00eb n\u00eb modalitetin e aktivizuar t\u00eb Secure Boot dhe duke fituar kontrollin e plot\u00eb mbi procesin e m\u00ebtejsh\u00ebm t\u00eb ngarkimit, p\u00ebrfshir\u00eb ngarkimin e nj\u00eb OS tjet\u00ebr, modifikimin e komponent\u00ebve t\u00eb sistemit operativ dhe rrethimin e mbrojtjes Lockdown. <\/p>\n
Ashtu si\u00e7 ndodhi me vulnerabilitetin e vitit t\u00eb kaluar BootHole, p\u00ebr t\u00eb bllokuar problemin nuk mjafton t\u00eb azhurnohet ngarkuesi, pasi sulmuesi, pavar\u00ebsisht sistemit operativ t\u00eb p\u00ebrdorur, mund t\u00eb p\u00ebrdor\u00eb nj\u00eb medium ngarkimi me nj\u00eb version t\u00eb vjet\u00ebr t\u00eb vulnerabilitetit GRUB2, t\u00eb verifikuar me n\u00ebnshkrim digjital. Problemi zgjidhet vet\u00ebm duke azhurnuar list\u00ebn e certifikatave t\u00eb t\u00ebrhequra (dbx, UEFI Revocation List), por n\u00eb k\u00ebt\u00eb rast do t\u00eb humbet mund\u00ebsia p\u00ebr t\u00eb p\u00ebrdorur mediume t\u00eb vjetra instalimi me Linux. <\/p>\n
N\u00eb sistemet me firmware, ku \u00ebsht\u00eb azhurnuar lista e certifikatave t\u00eb t\u00ebrhequra, n\u00eb modalitetin UEFI Secure Boot do t\u00eb mund t\u00eb ngarkohet vet\u00ebm nd\u00ebrtimet e azhurnuara t\u00eb distribucioneve Linux. Distribucionet do t\u00eb ken\u00eb nevoj\u00eb t\u00eb azhurnojn\u00eb instaluesit, ngarkuesit, paketat e b\u00ebrtham\u00ebs, firmware-t fwupd dhe shtres\u00ebn shim, duke gjeneruar n\u00ebnshkrime t\u00eb reja digjitale p\u00ebr to. P\u00ebrdoruesit do t\u00eb duhet t\u00eb azhurnojn\u00eb imazhet e instalimit dhe mediumet e tjera t\u00eb ngarkimit, si dhe t\u00eb ngarkojn\u00eb list\u00ebn e certifikatave t\u00eb t\u00ebrhequra (dbx) n\u00eb firmware UEFI. Deri n\u00eb azhurnimin e dbx n\u00eb UEFI, sistemi mbetet vulnerabil pavar\u00ebsisht instalimit t\u00eb azhurnimeve n\u00eb OS. Statusi i zgjidhjes s\u00eb vulnerabiliteteve mund t\u00eb vler\u00ebsohet n\u00eb k\u00ebto faqe: Ubuntu, SUSE, RHEL, Debian. <\/p>\n
P\u00ebr t\u00eb zgjidhur problemet q\u00eb lindin nga shp\u00ebrndarja e certifikatave t\u00eb revokuar, n\u00eb t\u00eb ardhmen planifikohet p\u00ebrdorimi i mekanizmit SBAT (UEFI Secure Boot Advanced Targeting), mb\u00ebshtetje p\u00ebr t\u00eb cilin \u00ebsht\u00eb realizuar p\u00ebr GRUB2, shim dhe fwupd, dhe duke filluar nga p\u00ebrdit\u00ebsimet e ardhshme do t\u00eb p\u00ebrdoret n\u00eb vend t\u00eb funksionalitetit q\u00eb ofrohet nga paketa dbxtool. SBAT \u00ebsht\u00eb zhvilluar n\u00eb bashk\u00ebpunim me Microsoft dhe parashikon shtimin e metadatat n\u00eb skedar\u00ebt ekzekutiv t\u00eb komponent\u00ebve UEFI q\u00eb p\u00ebrfshijn\u00eb informacion mbi prodhuesin, produktin, komponentin dhe versionin. K\u00ebto metadatat n\u00ebnshkruhen me nj\u00eb n\u00ebnshkrim digjital dhe mund t\u00eb p\u00ebrfshihen p\u00ebr m\u00eb tep\u00ebr n\u00eb listat e komponent\u00ebve t\u00eb lejuar ose t\u00eb ndaluar p\u00ebr UEFI Secure Boot. Pra, SBAT do t\u00eb lejoj\u00eb menaxhimin e numrave t\u00eb versioneve t\u00eb komponent\u00ebve pa nevoj\u00ebn p\u00ebr rigen\u00ebrimin e \u00e7el\u00ebsave p\u00ebr Secure Boot dhe pa formimin e n\u00ebnshkrimeve t\u00eb reja p\u00ebr kernelin, shim, grub2 dhe fwupd. <\/p>\n
Vulnerabilitetet e identifikuara: <\/p>\n
\n
CVE-2020-14372 \u2014 me ndihm\u00ebn e komand\u00ebs acpi n\u00eb GRUB2, nj\u00eb p\u00ebrdorues me privilegje i sistemit lokal mund t\u00eb ngarkoj\u00eb tabela ACPI t\u00eb modifikuara, duke vendosur SSDT (Tabela e Dyt\u00eb e P\u00ebrshkrimit t\u00eb Sistemit) n\u00eb katalogun \/boot\/efi dhe duke ndryshuar cil\u00ebsimet n\u00eb grub.cfg. Megjith\u00ebse modaliteti Secure Boot \u00ebsht\u00eb aktiv, SSDT i propozuar do t\u00eb ekzekutohet nga b\u00ebrthama dhe mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb \u00e7aktivizuar mbrojtjen LockDown, e cila bllokon rrug\u00ebt p\u00ebr t\u00eb anashkaluar UEFI Secure Boot. Si rezultat, sulmuesi mund t\u00eb arrij\u00eb t\u00eb ngarkoj\u00eb modul\u00ebn e tij t\u00eb b\u00ebrtham\u00ebs ose t\u00eb ekzekutoj\u00eb kod p\u00ebrmes mekanizmit kexec, pa verifikimin e n\u00ebnshkrimit digjital.\n
CVE-2020-25632 \u2014 aksesimi i nj\u00eb zone memorjeje t\u00eb \u00e7liruar (use-after-free) n\u00eb implementimin e komand\u00ebs rmmod, e cila shfaqet kur p\u00ebrpiqet t\u00eb shkarkoj\u00eb ndonj\u00eb modul pa marr\u00eb parasysh var\u00ebsit\u00eb e lidhura me t\u00eb. Vulnerabiliteti nuk p\u00ebrjashton krijimin e nj\u00eb eksploiti, i cili mund t\u00eb \u00e7oj\u00eb n\u00eb ekzekutimin e kodit duke anashkaluar verifikimin e Secure Boot.\n
CVE-2020-25647 \u2014 shkrimi jasht\u00eb kufijve t\u00eb tamponit n\u00eb funksionin grub_usb_device_initialize(), i cili thirret gjat\u00eb in\u00e7ializimit t\u00eb pajisjeve USB. Problemi mund t\u00eb shfryt\u00ebzohet p\u00ebrmes lidhjes s\u00eb nj\u00eb pajisjeje USB t\u00eb p\u00ebrgatitur posa\u00e7\u00ebrisht, e cila jep parametrat, me nj\u00eb madh\u00ebsi q\u00eb nuk korrespondon me mas\u00ebn e tamponit t\u00eb dedikuar p\u00ebr strukturat USB. Sulmuesi mund t\u00eb arrij\u00eb t\u00eb ekzekutoj\u00eb kodin, i cili nuk \u00ebsht\u00eb verifikuar n\u00eb Secure Boot, p\u00ebrmes manipulimeve me pajisjet USB.\n
CVE-2020-27749 \u2014 mbushja e tamponit n\u00eb funksionin grub_parser_split_cmdline(), e cila mund t\u00eb thirret duke specifikuar n\u00eb komand\u00ebn e linj\u00ebs GRUB2 variabla, me nj\u00eb madh\u00ebsi m\u00eb t\u00eb madhe se 1 KB. Vulnerabiliteti lejon t\u00eb arrihet ekzekutimi i kodit duke anashkaluar Secure Boot.\n
CVE-2020-27779 \u2014 komanda cutmem i jep mund\u00ebsin\u00eb sulmuesit t\u00eb heq\u00eb nj\u00eb gam\u00eb adresash nga memoria p\u00ebr t\u00eb anashkaluar Secure Boot.\n
CVE-2021-3418 \u2014 ndryshimet n\u00eb shim_lock krijuan nj\u00eb vektor shtes\u00eb p\u00ebr shfryt\u00ebzimin e vulnerabilitetit t\u00eb vitit t\u00eb kaluar CVE-2020-15705. Kur regjistrohej n\u00eb dbx nj\u00eb certifikat\u00eb q\u00eb p\u00ebrdorej p\u00ebr n\u00ebnshkrimin e GRUB2, GRUB2 lejonte ngarkimin e \u00e7do b\u00ebrthame direkt pa verifikimin e n\u00ebnshkrimit.\n
CVE-2021-20225 \u2014 mund\u00ebsia e shkrimit t\u00eb t\u00eb dh\u00ebnave jasht\u00eb kufijve t\u00eb tamponit gjat\u00eb ekzekutimit t\u00eb komandave me nj\u00eb num\u00ebr shum\u00eb t\u00eb madh opsionesh.\n
CVE-2021-20233 \u2014 mund\u00ebsia e shkrimit t\u00eb t\u00eb dh\u00ebnave jasht\u00eb kufijve t\u00eb tamponit p\u00ebr shkak t\u00eb llogaritjes s\u00eb gabuar t\u00eb madh\u00ebsis\u00eb s\u00eb tamponit gjat\u00eb p\u00ebrdorimit t\u00eb kuotave. Gjat\u00eb llogaritjes s\u00eb madh\u00ebsis\u00eb, ishte supozuar se p\u00ebr ekranuar nj\u00eb thonj\u00ebza t\u00eb vetme nevojiten tre simbole, kur n\u00eb t\u00eb v\u00ebrtet\u00eb nevojiten kat\u00ebr. <\/ul>\n