Security: GRUB, Thycotic, and 'Spectre'

-
Ubuntu Blog: GRUB2 Secure Boot Bypass 2021
In August 2020, a set of security vulnerabilities in GRUB2 (the GRand Unified Bootloader version 2) collectively known as BootHole were disclosed. Today, another set of vulnerabilities in GRUB2 were disclosed, with similar implications. Because GRUB2 is a key component of the boot process, vulnerabilities in it can permit attackers to violate the integrity promises of UEFI Secure Boot. In this blog post we will discuss these vulnerabilities as well as the changes that have been made to Ubuntu to both mitigate them, and to make the update process easier for any future similar scenarios.
As discussed back in August 2020, the UEFI Secure Boot process in Ubuntu is supported by a number of different components, all working together to ensure that only trusted bootloaders and operating systems are able to run. These consist of the UEFI platform firmware (aka UEFI BIOS), shim, the GRUB2 bootloader and the Linux kernel. The latter 3 of these are Ubuntu components, while the former is provided by the device OEM. In this case, both shim and GRUB2 have (or will soon receive updates) to mitigate these vulnerabilities and to help ensure older vulnerable versions of GRUB2 are not trusted by the secure boot process and cannot be used to load malicious code.
[...]
To ensure a unified approach, the version of GRUB2 for UEFI systems used in older Ubuntu releases is updated so that a single GRUB2 version can be used for all – this ensures that both the latest security fixes and mitigation features can be more easily adopted in these older releases. As this has the potential to cause issues in what is a fundamental component of the boot process (due to the large number of changes in both GRUB2 itself as well as the way this is distributed in Ubuntu), this update will be carefully rolled out via the Updates pocket of the Ubuntu package archive.
Because Secure Boot does not apply to BIOS based boot environments, we will not be publishing updates for GRUB2 on those systems.
-
Multiple New Security Issues Hit GRUB Bootloader Around Secure Boot
A new set of GRUB2 security vulnerabilities were made public today affecting its UEFI Secure Boot support. A set of eight CVEs were issued in 2020 and this year for the new issues. The issues include the possibility of specially crafted ACPI tables being loaded even if Secure Boot is active, memory corruption in GRUB's menu rendering, use-after-free in rmmod functionality, the cutmem command allowing privileged users to disable certain memory regions and in turn Secure Boot protections, arbitrary code execution even if Secure Boot is enabled, GRUB 2.05 accidentally re-introducing one of last year's vulnerabilities, and memory corruption from crafted USB device descriptors that could lead to arbitrary code execution.
-
Thycotic Announces Endpoint Privilege Management Solution for Unix/Linux
Thycotic, provider of privileged access management (PAM) solutions for more than 12,500 organizations worldwide, including 25 of the Fortune 100, announced new privilege management capabilities for workstations running Unix and Linux. The latest release of Thycotic’s Privilege Manager solution includes a Sudo plugin that saves Unix/Linux administrators time, while still providing granular control over privileged activities.
According to the Verizon 2020 Data Breach Investigations Report, eighty percent of breaches involve compromised credentials, making them one of the most common entry points for threats. Unix and Linux endpoints are typically the most valuable targets because they rely on “root” accounts, which provide unrestricted access to all commands, files, directories, and resources.
-
Spectre returns as exploits for Windows and Linux devices found
Remember Spectre, the infamous vulnerability that had all major chip manufacturers scrambling for a fix? Three years after its initial emergence, two new working exploits have been identified.
According to a report from Bleeping Computer, security researcher Julien Voisin has discovered a pair of exploits targeting unpatched Linux and Windows systems, on the VirusTotal platform. VirusTotal gathers all antivirus scans in one place and checks for potential malware missed by different solutions, and these exploits were uploaded a month ago.
-
- Login or register to post comments
Printer-friendly version
- 4680 reads
PDF version
More in Tux Machines
- Highlights
- Front Page
- Latest Headlines
- Archive
- Recent comments
- All-Time Popular Stories
- Hot Topics
- New Members
KDE Frameworks 5.81 Released with KHamburgerMenu, Various Improvements
The biggest new feature in the KDE Frameworks 5.81 release is the implementation of a new, custom hamburger menu called KHamburgerMenu, which will be shown on QWidgets-based apps whenever the main menubar is hidden.
The KDE Project plans to adopt the KHamburgerMenu for all KDE apps as it offers several advantages, including an alternative app menu in case you hide the default menubar by accident, more freedom when you want to take full advantage of the maximum vertical space, more compact design with only relevant menu items, as well as support for relocating, renaming, removing, or even changing its icon.
| today's leftovers
|
Devices/Embedded Hardware
| Programming Leftovers
|
Microsoft is serving malware again
Malicious ‘Dependency Confusion’ packages are stealing password files [Ed: Microsoft is serving malware again but Microsoft partners don't name Microsoft]
SUSE on GRUB
SUSE addresses another grub2 UEFI secure boot security exposure
Microsoft boosters
GRUB2 boot loader reveals multiple high severity vulnerabilities [Ed: Microsoft interjected fake (non) security into Linux and is now boasting and celebrating the dire consequences in its loyal propaganda sites]