A Microsoft researcher found it-and it's somehow Microsoft's fault.
A critical vulnerability in most Linux distributions now has a patch ready.
Enterprise users especially need this if booting using HTTP or PXE. So go get it.
In today's SB Blogwatch, we patch shim and update the DBX. Your humble blogwatcher curated these bloggy bits for your entertainment.
It] could prove useful if an attacker has already gained some level of access inside a network and is looking to take control of connected end-user devices.
The vulnerability resides in shim a small component that runs early in the boot process before the operating system has started.
It] resides in a part of the shim that processes booting up from a central server on a network using HTTP.The ability to execute code during the boot process constitutes a major escalation of whatever access an attacker already has.
It means the attacker can neutralize many forms of endpoint protection.
Shim is a small open-source bootloader maintained by Red Hat that is designed to facilitate the Secure Boot process on computers using Unified Extensible Firmware Interface.
Linux users are advised to update to the latest version of Shim, v15.8, which contains a fix for CVE-2023-40547 and five other important vulnerabilities.
Although unlikely to be mass-exploited, [it] is not a bug that should be ignored, as executing code before OS boot is one of the strongest and stealthiest forms of system compromise.
While on the surface this may look like an issue only affecting Red Hat this vulnerability impacts all Linux distributions that support Secure Boot including Debian, Ubuntu, SUSE, and others.
Alongside updating to the new shim version containing the patch the Secure Boot chain of trust must [also] be updated.
This means the UEFI Secure Boot DBX must be updated to include the hashes of the vulnerable shim software.
It's] a piece of code that is jointly-terrible-a bad compromise forced on the Linux community by Intel/Microsoft through the UEFI architecture (Secure Boot).
If an organization is so behind the times that they're still deploying boot images over an unencrypted HTTP server, then it's fairly likely that they also won't have the ability to deal with these current issues either.
A common misconception I've seen is that this only affects you if you use HTTP boot.
If that were true, this wouldn't be a Critical bug.
Literally almost ground zero for the whole chain of trust when it comes to booting with secure boot.2.
Networks are big and scary places, and once you break the secure boot process, you can make it load binaries from across the globe over simple http.
This Cyber News was published on securityboulevard.com. Publication date: Thu, 08 Feb 2024 17:43:04 +0000