iTnews
  • Home
  • News
  • Technology
  • Security

Boothole GRUB2 bug breaks Secure Boot on Linux and Windows

By Juha Saarinen on Jul 30, 2020 12:39PM
Boothole GRUB2 bug breaks Secure Boot on Linux and Windows

Fixes will have to be carefully tested and deployed to avoid bricking.

A security vendor has discovered a way to execute arbitrary code during the computer boot-up process through a relatively simple to exploit bug and devise attacks that can get through the Unified Extensible Firmware Interface (UEFI) Secure Boot feature to provide full system access for malware.

Enterprise security vendor Eclypsium found that the grub.cfg text file for the Grand Unified Bootloader 2 (GRUB2), which is used by Linux distributions since 2009, can be altered to trigger a buffer overflow.

By increasing the size of a token in grub.cfg, it is possible for attackers to take advantage of a mismatched design assumption that causes the GRUB2 parser not to halt execution as expected, but simply prints out an error message and returns to the calling function.

"As a result, an attacker could modify the contents of the GRUB2 configuration file to ensure that attack code is run before the operating system is loaded. In this way, attackers gain persistence on the device," Eclypsium wrote in its analysis.

Data can be written anywhere in memory with the bug, Eclypsium found.

Furthermore, as the UEFI execution environment doesn't take advantage of address space randomisation layout or data execution prevention (ASLR/DEP) security features, creating exploits for the vulnerability is easy, without resorting to building return-oriented programming chains, the security vendor said.

Apart from Linux systems, computers that run Windows 8 and 10 and which use the standard Microsoft Third Party UEFI Certificate Authority can be attacked with Boothole, Eclypsium said.

Attackers need administrator privileges to modify the grub.cfg file, but Eclypsium noted that this can be done without tampering with the integrity of signed vendor shims that contain  certificates and code for verifying the GRUB2 bootloader as it's loaded.

Ransomware and malware have been known to replace legit UEFI bootloaders with malicious variants, security vendor ESET found in June this year.

Eclypsium has notified Microsoft, Linux distributors Red Hat, SuSE, Canonical/Ubuntu, Debian as well as Citrix, VMware, computer original equipment manufacturers (OEMs) and software developers about the bug, which is rated as high impact with an 8.2 out of 10 CVSS score.

However, Eclypsium notes that fixing the Boothole bug could be slow as UEFI-related updates have a history of bricking devices.

Enterprise disaster and recovery tools could also run into problems if the dbx revocation list is updated before Linux bootloaders and shims.

This could stop recovery media from being able to boot up systems.

As a result, vendors have to be very careful when deploying fixes for Boothole.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © iTnews.com.au . All rights reserved.
Tags:
bootholeeclypsiumgrub2linuxsecure bootsecuritywindows

Partner Content

Security: Understanding the fundamentals of governance, risk & compliance
Promoted Content Security: Understanding the fundamentals of governance, risk & compliance
Why rethinking your CMS is crucial for customer retention
Promoted Content Why rethinking your CMS is crucial for customer retention
Security "mindset shift" needed to protect organisations
Promoted Content Security "mindset shift" needed to protect organisations
Why Genworth Australia embraced low-code software development
Promoted Content Why Genworth Australia embraced low-code software development

Sponsored Whitepapers

Extracting the value of data using Unified Observability
Extracting the value of data using Unified Observability
Planning before the breach: You can’t protect what you can’t see
Planning before the breach: You can’t protect what you can’t see
Beyond FTP: Securing and Managing File Transfers
Beyond FTP: Securing and Managing File Transfers
NextGen Security Operations: A Roadmap for the Future
NextGen Security Operations: A Roadmap for the Future
Video: Watch Juniper talk about its Aston Martin partnership
Video: Watch Juniper talk about its Aston Martin partnership

Events

  • Micro Focus Information Management & Governance (IM&G) Forum 2022
  • CRN Channel Meets: CyberSecurity Live Event
  • IoT Insights: Secure By Design for manufacturing
  • Cyber Security for Government Summit
  • Forrester Technology & Innovation Asia Pacific 2022
By Juha Saarinen
Jul 30 2020
12:39PM
0 Comments

Related Articles

  • Poor patching creates easy zero-day vulnerability reuse
  • Don't remove PowerShell: US, UK and NZ security agencies
  • Microsoft won't fix 'Dogwalk' zero-day from 2020
  • Patch now against Linux 'Nimbuspwn' root priv-esc bugs
Share on Twitter Share on Facebook Share on LinkedIn Share on Whatsapp Email A Friend

Most Read Articles

Qantas calls time on IBM, Fujitsu in tech modernisation

Qantas calls time on IBM, Fujitsu in tech modernisation

PayTo rollout kicks off

PayTo rollout kicks off

Researchers hacked Oracle servers to demo serious vulnerability

Researchers hacked Oracle servers to demo serious vulnerability

Neobank Volt exits the banking industry

Neobank Volt exits the banking industry

Digital Nation

Integrity, ethics and board decisions in the digital age
Integrity, ethics and board decisions in the digital age
The security threat of quantum computing
The security threat of quantum computing
Crypto experts optimistic about future of Bitcoin: Block
Crypto experts optimistic about future of Bitcoin: Block
IBM global chief data officer on the rise of the number crunchers
IBM global chief data officer on the rise of the number crunchers
COVER STORY: Operationalising net zero through the power of IoT
COVER STORY: Operationalising net zero through the power of IoT
All rights reserved. This material may not be published, broadcast, rewritten or redistributed in any form without prior authorisation.
Your use of this website constitutes acceptance of nextmedia's Privacy Policy and Terms & Conditions.