Muva nje kukhishwe izindaba zokuthi ubungozi obungu-7 bulungisiwe isilayishi sebhuthi GRUB2 okuvumela indlela ye-UEFI Secure Boot ukuthi yeqiwe futhi ivumele ukwenziwa kwekhodi okungaqinisekisiwe, isibonelo ngokujova uhlelo olungayilungele ikhompuyutha olusebenza ezingeni le-bootloader noma le-kernel.
Futhi, kukhona ubungozi kungqimba lwe-shim, okuvumela futhi i-UEFI Secure Boot ukuthi idlule. Iqembu lobungozi laqanjwa ngekhodi elithi Boothole 3, elifana nezindaba ezifanayo ezikhonjwe ngaphambilini ku-bootloader.
Imethadatha eshiwo isayinwe ngedijithali futhi ingafakwa ngokuhlukile ohlwini lwezingxenye ezivunyelwe noma ezivinjelwe ze-UEFI Secure Boot.
Ukusabalalisa okuningi kwe-Linux kusebenzisa ungqimba lwe-patch oluncane, olusayinwe ngedijithali yi-Microsoft, ukuze luqalise ukuqinisekiswa kumodi ye-UEFI Secure Boot. Lesi sendlalelo siqinisekisa i-GRUB2 ngesitifiketi sayo, esivumela abathuthukisi bokusabalalisa ukuthi baqinisekise yonke i-kernel kanye nesibuyekezo se-GRUB nge-Microsoft.
Ubungozi ku-GRUB2 buvumela ukwenziwa kwekhodi yokuqinisekisa i-shim ephumelelayo, kodwa ngaphambi kokulayisha isistimu yokusebenza, faka uchungechunge lokwethenjwa ngemodi yokuqalisa evikelekile esebenzayo futhi uthole ukulawula okugcwele phezu kwenqubo yokuqalisa elandelayo okuhlanganisa ukubhutha enye isistimu yokusebenza, ukuguqula izingxenye zesistimu yesistimu yokusebenza kanye nokuvikelwa kwelokhi ye-bypass.
Esikhundleni sokuhoxisa isiginesha, I-SBAT ivumela ukuvimbela ukusetshenziswa kwayo kwezinombolo zenguqulo yengxenye ngayinye asikho isidingo sokuhoxisa okhiye be-Secure Boot. Ukuvimbela ubungozi nge-SBAT akudingi ukusetshenziswa kwe-UEFI CRL (dbx), kodwa kwenziwa kuleveli yokhiye wangaphakathi wokushintsha ukuze kukhiqizwe amasiginesha nokubuyekeza i-GRUB2, i-shim, namanye ama-artifact ebhuthi ahlinzekwa ngokusatshalaliswa. Ukusekelwa kwe-SBAT manje sekungeziwe ekusatshalalisweni kweLinux okudume kakhulu.
I-Las ubuthakathaka obukhonjiwe bumi kanje:
- CVE-2021-3696, CVE-2021-3695- Isigcinalwazi se-Heap siyachichima lapho sicubungula izithombe ze-PNG eziklanywe ngokukhethekile, ezingase zisetshenziselwe ukumisa ukubulawa kwekhodi yokuhlasela futhi kudlule i-UEFI Secure Boot. Kuyaphawulwa ukuthi inkinga inzima ukuyisebenzisa, njengoba ukudala ukuxhaphaza okusebenzayo kudinga ukucabangela inani elikhulu lezici kanye nokutholakala kolwazi lwesakhiwo sememori.
- I-CVE-2021-3697: i-buffer underflow kukhodi yokucubungula isithombe ye-JPEG. Ukusebenzisa inkinga kudinga ulwazi lwesakhiwo senkumbulo futhi kumayelana nezinga eliyinkimbinkimbi elifanayo nenkinga ye-PNG (CVSS 7.5).
- I-CVE-2022-28733: Inani eliphelele elichichimayo kumsebenzi we-grub_net_recv_ip4_packets() okuvumela ukuthi uthonye ipharamitha ethi rsm->total_len ngokuthumela iphakethe le-IP eliklanywe ngokukhethekile. Inkinga imakwe njengokuyingozi kakhulu kobungozi obuthunyelwe (CVSS 8.1). Uma busetshenziswe ngempumelelo, ukuba sengozini kuvumela idatha ukuthi ibhalwe ngaphandle komngcele webhafa ngokunikezela ngamabomu usayizi wenkumbulo omncane.
- I-CVE-2022-28734: Ukuchichima kwebhayithi yebhayithi eyodwa lapho kucutshungulwa izihloko ze-HTTP ezihlukanisiwe. Inkinga ingabangela imethadatha ye-GRUB2 ukuthi yonakale (bhala i-null byte ngemva nje kokuphela kwebhafa) lapho uhlaziya izicelo ze-HTTP eziklanywe ngokukhethekile.
- I-CVE-2022-28735: inkinga kusihloli se-shim_lock esivumela amafayela angewona ama-kernel ukuthi alayishwe. Ukuba sengozini kungase kusetshenziswe ukuze kuqaliswe amamojula e-kernel engasayiniwe noma ikhodi engaqinisekisiwe kumodi Yokuvula Secure UEFI.
- I-CVE-2022-28736: Ukufinyelela endaweni yenkumbulo esivele ikhululiwe kumsebenzi we-grub_cmd_chainloader() ngokwenza kabusha umyalo we-chainloader osetshenziselwa ukulayisha amasistimu wokusebenza angasekelwe yi-GRUB2. Ukuxhashazwa kungaholela ekusetshenzisweni kwekhodi yomhlaseli uma umhlaseli ekwazi ukunquma imininingwane yokwabiwa kwememori ku-GRUB2.
- I-CVE-2022-28737: Lungisa ukuchichima kwebhafa yesendlalelo ku-handle_image() umsebenzi lapho ulayisha futhi usebenzisa izithombe ze-EFI zangokwezifiso.
Ukuxazulula inkinga ye-GRUB2 kanye ne-shim, ukusatshalaliswa kuzokwazi ukusebenzisa indlela ye-SBAT (Usefi Secure Boot Advanced Targeting), ehambisana ne-GRUB2, shim, kanye fwupd. I-SBAT yathuthukiswa ngokubambisana ne-Microsoft futhi ihilela ukwengeza imethadatha eyengeziwe engxenyeni ye-UEFI yamafayela asebenzisekayo, okuhlanganisa nomkhiqizi, umkhiqizo, ingxenye, nolwazi lwenguqulo.
Ekugcineni, uma unentshisekelo yokwazi kabanzi ngakho, ungaxhumana nemininingwane Kulesi sixhumanisi esilandelayo.