Vulnerabilities in GRUB2, allowing you to get around UEFI Secure Boot

In the GRUB2 7 vulnerabilities that allow you to bypass the UEFI mechanism Secure Boot and achieve the launch of an unbelied code, for example, to implement malicious software operating at the bootloader or nucleus. Additionally, one vulnerability in the SIM layer is also noted, which also allows you to bypass UEFI Secure Boot. The group of vulnerabilities received the code name Boothole 3, by analogy with similar problems previously identified in the bootloader.

To eliminate problems in GRUB2 and SHIM, distributions will be able to use the mechanism sbat (uepi secure boot advanced Targeting), which is supported by GRUB2, SHIM and FWUPD. SBAT is developed in conjunction with Microsoft and involves the addition of additional metadata to executable UEFI components, which include information about the manufacturer, product, component and version. These metadata are certified by digital signature and can separately be included in the lists of allowed or prohibited components for UEFI Secure Boot.

In most Linux-displacements for verified loading in UEFI Secure Boot mode, a small layer of Shim is used, certified by a digital signature of Microsoft. This layer verifies GRUB2 with its own certificate, which allows the developers of distributions not to certify each renewal of the nucleus and GRUB in Microsoft. Vulnerabilities in GRUB2 allow you to achieve your code at the stage after the successful verification of the SHIM, but before loading the operating system, wedging into the confidence chain under the active secure boot mode and getting full control over the further loading process, including for loading another OS, modify the components of the operating room Lockdown protection systems and bypassing.

To eliminate problems in the bootloader, distributions have to form new digital signatures and update installers, bootloaders, core packages, FWUPD-rovers and a SHIM-layer, since old assemblies cannot be used when the digital signature of the vulnerable component in recording of the withdrawn certificates (DBX, UEFI Revocation List). Prior to the implementation of SBAT, updating the list of recalled certificates was a prerequisite for the full blocking of vulnerability, since the attacking, regardless of the operating system used, could use the loading medium with the old vulnerable version of the GRUB2, certified by the digital signature.

to compromise the UEFI Secure Boot.

Instead of recalling the SBAT signature, it allows you to block its use for individual numbers of versions of components without the need to recall the keys for Secure Boot. Blocking vulnerabilities through sbat does not require the list of recalled UEFI certificates (DBX), but is made at the level replacement of the key to form signatures and update GRUB2, SHIM and other distributions of loading artifacts. Currently, SBAT support has already been added to most popular Linux distributions.

identified vulnerability:

• cve-2021-3696