8 kusagadzikana kwakazivikanwa muGRUB2 iyo inobvumidza kuitiswa kwekodhi isina chokwadi

Munguva pfupi yapfuura Ruzivo nezve 8 kushushikana muGRUB2 bootloader yakaburitswaque inobvumidza kupfuura iyo UEFI yakachengeteka bhuti michina uye kuve isina kuvimbiswa kodhi kumhanyaSemuenzaniso, kubaya malware inomhanya pa bootloader kana kernel level.

Rangarira kuti munzvimbo zhinji dzeLinux, kune boot yakavhenekerwa muEFI yakachengeteka boot mode, diki diki rekubhadhara rinozivikanwa neMicrosoft siginicha yedhijitari inoshandiswa.

Iyi dura inoongorora GRUB2 ichipesana nechayo chitupa, ichibvumira vanogadzira kuti varege kusimbisa kernel yega yega uye kugadzirisa kubva kuGRUB kuenda kuMicrosoft.

Nayo kusagadzikana muGRUB2 kunokutendera kuti uwane kuitisa kodhi yako mune yekumashure-yekusimbisa nhanho kugadziriswa kwakabudirira, asi pamberi peiyo mashandiro esisitimu anoremerwa, kukodzera muketani yekuvimba kana Yakachengeteka Boot iri kushanda uye kuwana izere kutonga pane inotevera bhuti maitiro, kusanganisira kubhowa imwe sisitimu yekushandisa, kugadzirisa iyo chikamu sisitimu yeanoshanda system uye nekupfuura dziviriro .

Sezvazviri mune iyo njodzi yeBootHole kubva gore rapfuura, kumutsiridza bootloader hakuna kukwana kuvhara dambudzikoSemunhu anorwisa, zvisinei nehurongwa hwekushandisa hunoshandiswa, anogona kushandisa bhutsu midhiya neyakare nenjodzi vhezheni yeGRUB2, yakasimbiswa nesiginicha yedhijitari, kukanganisa UEFI Yakachengeteka Boot.

Dambudziko rinogadziriswa chete nekuvandudza runyorwa rwezvitupa zvakabviswa (dbx, UEFI Revocation Rondedzero), asi mune ino kesi, kugona kushandisa yekare yekuisa midhiya neLinux kucharasika.

Pane masystem ane firmware uko runyorwa rwezvitupa zvakabviswa zvakagadziridzwa, akagadziridzwa maseti ekuparadzirwa kweLinux anogona kungotakurwa muEFI Yakachengeteka Boot mode.

Kugovera kunozoda kugadzirisa vanoisa, bootloaders, kernel mapakeji, fwupd firmware, uye mupiro wekuripa nekuvagadzira masiginecha matsva edhijitari kwavari.

Vashandisi vachada kunatsurudza yekuisa mifananidzo uye mamwe midhiya midhiya uye dhawunirodha gwaro rekudzosera chitupa (dbx) muEFI firmware. Kusvikira iyo dbx inogadziridza muEFI, sisitimu yacho inoramba iri panjodzi zvisinei nekumisikidzwa kwezvishandiso muhurongwa hwekushandisa.

Kugadzirisa matambudziko akatorwa yekugovera zvitupa zvakabviswa, inorongwa kushandisa SBAT mashandiro mune ramangwana (UEFI Yakachengeteka Boot Yakananga Targeting), iyo ikozvino inotsigira GRUB2, shim, uye fwupd, uye ichatsiva mashandiro akapihwa neiyo dbxtool package mune ramangwana zvigadziriso. SBAT yaive yakagadzirirwa pamwe neMicrosoft kuwedzera metadata nyowani kuEFI chinhu chinogoneka mafaera, izvo zvinosanganisira mugadziri, chigadzirwa, chikamu, uye vhezheni ruzivo.

Pamatambudziko akaonekwa:

1. CVE-2020-14372- Nemutemo weacpi paGRUB2, mushandisi ane rukudzo pane ino sisitimu anokwanisa kurodha tafura dze ACPI dzakarongedzwa nekuisa SSDT (yechipiri system tsananguro tafura) mu / boot / efi dhairekitori uye nekushandura marongero mu grub.cfg.
2. CVE-2020-25632: kuwana nzvimbo yekurangarira yakatosunungurwa (use-after-free) mukumisikidza iyo rmmod rairo, iyo inoratidzwa kana uchiedza kurodha chero module pasina kufunga nezvayo zvinoenderana zvinoenderana.
3. CVE-2020-25647: Nyora kunze kwemiganhu ye buffer mu grub_usb_device_initialize () basa rakadaidzwa kana uchitanga zvigadzirwa zve USB. Dambudziko rinogona kushandiswa nekubatanidza mudziyo unogadzirirwa we USB unogadzira parameter isingaenderane nehukuru hwetabha yakapihwa zvimiro zveUSB.
4. CVE-2020-27749: buffer kufashukira mu grub_parser_split_cmdline () iyo inogona kukonzerwa nekutsanangudza misiyano yakakura kudarika 1 KB pane GRUB2 yekuraira tambo. Iyo kusagadzikana kunogona kubvumidza kodhi kuitiswa pasina kupfuura kuburikidza neKachengeteka Boot.
5. CVE-2020-27779: iyo cutmem yekuraira inobvumira anorwisa kuti abvise huwandu hweateresi kubva mundangariro kuti apfuure akachengeteka bhuti.
6. CVE-2021-3418: shanduko ku shim_lock yakagadzira imwe vector yekushandisa yegore rapfuura CVE-2020-15705 kutambura. Nekuisa chitupa chinoshandiswa kusaina GRUB2 mu dbx, GRUB2 yakabvumidza chero kernel kutakura yakanangana pasina kuongorora siginecha.
7. CVE-2021-20225: iko kugona kunyora data kunze kweye buffer kana uchiita mirairo nenhamba huru yesarudzo.
8. CVE-2021-20233: Kugona kunyora dhata kunze kweye buffer nekuda kweiyo isiriyo buffer saizi kuverenga kana uchishandisa makotesheni. Kana uchiverenga saizi, zvaifungidzirwa kuti zvinotora mavara matatu kuti apunyuke kamwe chete, kunyangwe muchokwadi zvinotora zvina.

mabviro: https://ubuntu.com