Kuna amfani da Grub2? ya kamata ka sabunta yanzu, kamar yadda suka gano game da yanayin rauni 8

Idan kuna amfani da Grub2 azaman bootloader ɗinka akan kwamfutarka bari na fada muku cewa ya kamata ku sabunta shi yanzuda kyau kwanan nan An bayyana raunin 8 a cikin wannan bootloader GRUB2 wanda ɗayansu ke alama da mahimmanci.

Mafi hadari daga cikinsu shine wanda aka lika tare da sunan lambar BootHole (CVE-2020 zuwa 10713). An gano wannan yanayin yana ba da damar ƙetare kayan aikin boot na UEFI da kuma shigar da software mara kyau ba tare da tabbaci ba.

Abinda ke tattare da wannan yanayin shi ne, Don gyara shi, bai isa ba don sabunta GRUB2 kamar yadda mai kawo hari zai iya amfani da kafofin watsa labarai tare da sigar mai rauni baya Tabbatar da shi ta hanyar sa hannu na dijital. Wani mai kawo hari na iya daidaita aikin tabbatarwa ba kawai ga Linux ba, har ma da sauran tsarin aiki, gami da Windows.

Kuma matsalar ita ce yawancin rarraba Linux suna amfani dashi karamin Layer na shim don tabbataccen taya, wanda kamfanin Microsoft ya sanya hannu a kan lambobi.

Wannan shimfidar tana tabbatar da GRUB2 tare da takaddun takaddun kanta, ƙyale masu haɓaka rarraba don ba da tabbacin kowane kwayar GRUB da sabuntawa zuwa Microsoft.

Vulnewarewa yana ba da damar, lokacin canza abun cikin grub.cfg, cimma aiwatar da lambar ka a matakin bayan tabbatacciyar nasarar tabbatar da shim, amma kafin tsarin aiki yayi lodi, dacewa cikin sashin amintacce lokacin da Takardar Amintaccen aiki ke aiki da samun iko Idaya game da ƙarin aikin taya, gami da ƙaddamar da wani tsarin aiki, gyaggyara abubuwan tsarin aiki, da tsallake kariyar haɗari.

Rashin lafiyar ya samo asali ne sakamakon ambaliyar ruwa wanda za'a iya amfani dashi don aiwatar da lambar ƙira ba tare da izini ba yayin aikin saukarwa. Rashin lafiyar ya bayyana kansa lokacin nazarin abubuwan cikin fayil ɗin sanyi na grub.cfg, wanda galibi yana kan ɓangaren ESP (EFI System Partition) kuma maharin zai iya shirya shi tare da haƙƙin mai gudanarwa, ba tare da keta mutuncin masu sanya hannu da kuma masu zartar da GRUB2 ba.

Ta hanyar kuskure a lambar fassarar sanyi, mai kula da kuskuren kuskuren YY_FATAL_ERROR kawai ya nuna gargadi, amma bai dakatar da shirin ba. Haɗarin rauni yana raguwa ta hanyar buƙatar samun dama mai dama ga tsarin; duk da haka, matsalar na iya zama dole don aiwatar da ɓoyayyen tushen kayan a gaban samun damar zahiri zuwa na'urar (idan zai yiwu a tayata daga kafofin watsa labarai).

Daga sauran raunin da aka samu:

• BAKU-2020-14308: Buffer ya cika saboda girman yanki mai ƙwaƙwalwar da ba a tabbatar da shi a cikin grub_malloc.
• BAKU-2020-14309: adadin ya wuce gona da iri a cikin grub_squash_read_symlink, wanda zai iya sa a rubuta bayanai a waje da abin da aka tanada.
• BAKU-2020-14310: adadin ya wuce gona da iri a cikin read_section_from_string, wanda zai iya sa a rubuta bayanai a waje da abin da aka ware.
• BAKU-2020-14311: adadin ya wuce gona da iri a cikin grub_ext2_read_link, wanda zai iya sa a rubuta bayanai a waje da abin da aka tanada.
• BAKU-2020-15705: yana ba da damar kunna kernels kai tsaye a yanayin amintaccen taya ba tare da interlayer mai shiga tsakani ba.
• CVE-2020-15706: samun dama zuwa yankin ƙwaƙwalwa wanda aka riga aka 'yanta shi (amfani-bayan-kyauta) lokacin zubar da aiki a lokacin aiki.
• BAKU-2020-15707: lamba ta malalo a cikin girman mai kulawa.

Magani

Kodayake duk ba a rasa ba, tunda, don magance wannan matsalar, kawai sabunta jerin takaddun takaddun da aka soke (dbx, Jerin Sokewa na UEFI) akan tsarin, amma a wannan yanayin, ikon amfani da tsohuwar hanyar watsa labarai tare da Linux zai rasa.

Wasu masana'antun kayan masarufi sun riga sun haɗa da jerin ingantattun takaddun takaddun shaida a cikin firmware; A kan irin waɗannan tsarukan, a cikin modea'idar Amintaccen Boot na UEFI, kawai sabunta kayan Linux za a iya ɗorawa.

Don gyara yanayin rauni a cikin rarrabawa, masu sakawa, bootloaders, kunshin kernel, fwupd firmware da Layer karfinsu suma zasu buƙaci a sabunta su, samar da sabbin sa hannun dijital a gare su.

Masu amfani za su buƙaci sabunta hotunan shigarwa da sauran kafofin watsa labarai na taya, kuma zazzage Jerin Sake Takaddun Shafin (dbx) a cikin firmware na UEFI. Har zuwa sabunta dbx a cikin UEFI, tsarin ya kasance mai rauni ba tare da la'akari da shigarwar sabuntawa a cikin tsarin aiki ba.

A karshe an ruwaito cewa an sake sabunta fakitin faci na Debian, Ubuntu, RHEL da SUSE, kazalika ga GRUB2 an fitar da facin faci.