Windows 10: BootHole vulnerability in Secure Boot affecting Linux and Windows

Brink · Jul 29, 2020

âBootHoleâ vulnerability in the GRUB2 bootloader opens up Windows and Linux devices using Secure Boot to attack. All operating systems using GRUB2 with Secure Boot must release new installers and bootloaders.

Join Eclypsium for a webinar âManaging The Hole In Secure Bootâ on August 5th, where CEO Yuriy Bulygin and VP R&D John Loucaides will provide advice on mitigating this vulnerability.

Download the PDF >

INTRODUCTION

Eclypsium researchers have discovered a vulnerability â dubbed âBootHoleâ â in the GRUB2 bootloader utilized by most Linux systems that can be used to gain arbitrary code execution during the boot process, even when Secure Boot is enabled. Attackers exploiting this vulnerability can install persistent and stealthy bootkits or malicious bootloaders that could give them near-total control over the victim device.

The vulnerability affects systems using Secure Boot, even if they are not using GRUB2. Almost all signed versions of GRUB2 are vulnerable, meaning virtually every Linux distribution is affected. In addition, GRUB2 supports other operating systems, kernels and hypervisors such as Xen. The problem also extends to any Windows device that uses Secure Boot with the standard Microsoft Third Party UEFI Certificate Authority. Thus the majority of laptops, desktops, servers and workstations are affected, as well as network appliances and other special purpose equipment used in industrial, healthcare, financial and other industries. This vulnerability makes these devices susceptible to attackers such as the threat actors recently discovered using malicious UEFI bootloaders.

Eclypsium has coordinated the responsible disclosure of this vulnerability with a variety of industry entities, including OS vendors, computer manufacturers, and CERTs. Mitigation will require new bootloaders to be signed and deployed, and vulnerable bootloaders should be revoked to prevent adversaries from using older, vulnerable versions in an attack. This will likely be a long process and take considerable time for organizations to complete patching.

TABLE OF CONTENTS

Background: Secure Boot, GRUB2, and CAs

Threats to the Boot Process

UEFI Secure Boot

Chains of Trust and GRUB2

Challenges of Secure Boot

Breaking Secure Boot Through GRUB2

Vulnerability Analysis

Additional Vulnerabilities

Impact

Mitigation

Recommendations

Conclusions

Click to expand...

Read more: https://eclypsium.com/2020/07/29/the...e-in-the-boot/

:)

Damn_Smooth · Jul 29, 2020

Windows 8 Secure Boot Feature: Not So Secure?

Linux

Linux

Linux

Linux

Oh and OSX

Here is a statement from a Kernal Developer at Red Hat:

I'm not sure this exploits the legacy BIOS but rather it exploits the legacy boot method on MBR drives, injecting a signed key before the OS boots, which you are correct in that it has nothing to do with Windows 8. And the simplest fix would just be to require boot drives use GPT when Secure Boot is enabled in UEFI.
Click to expand...

So Linux is switching to secure boot also? Or they have to because of UEFI?

newtekie1 · Jul 29, 2020

Windows 8 Secure Boot Feature: Not So Secure?

I would appreciate your list of other OS's implementing this feature. Thanks.
Click to expand...

Linux

Linux

Linux

Linux

Oh and OSX

Here is a statement from a Kernal Developer at Red Hat:

We don't really support secure boot right now, but that's ok because you can't buy any hardware that supports it yet. Adding support is probably about a week's worth of effort at most.
Click to expand...

This exploits the legacy BIOS. Not UEFI and has nothing to do with the Windows 8 support of UEFI Secure Boot.
Click to expand...

I'm not sure this exploits the legacy BIOS but rather it exploits the legacy boot method on MBR drives, injecting a signed key before the OS boots, which you are correct in that it has nothing to do with Windows 8. And the simplest fix would just be to require boot drives use GPT when Secure Boot is enabled in UEFI.

Yukikaze · Jul 29, 2020

WPA2 Vulnerability Found

A small update with regards to the Microsoft fix. The fix itself is sufficient to solve the issue on Windows, even if your WiFi device has no driver update, with one caveat:

Does this security update fully address these vulnerabilities on Microsoft Platforms, or do I need to perform any additional steps to be fully protected?
The provided security updates address the reported vulnerabilities; however, when affected Windows based systems enter a connected standby mode in low power situations, the vulnerable functionality may be offloaded to installed Wi-Fi hardware. To fully address potential vulnerabilities, you are also encouraged to contact your Wi-Fi hardware vendor to obtain updated device drivers. For a listing of affected vendors with links to their documentation, review the ICASI Multi-Vendor Vulnerability Disclosure statement here: Statement from the Industry Consortium for Advancement of Security on the Internet (ICASI) on the Wi-Fi Protected Access (WPA) Vulnerabilities

Source: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-13080

Windows 10: BootHole vulnerability in Secure Boot affecting Linux and Windows

BootHole vulnerability in Secure Boot affecting Linux and Windows

BootHole vulnerability in Secure Boot affecting Linux and Windows

BootHole vulnerability in Secure Boot affecting Linux and Windows

BootHole vulnerability in Secure Boot affecting Linux and Windows - Similar Threads - BootHole vulnerability Secure

KB5012170 Secure Boothole is already installed.

KB5012170 Secure Boothole is already installed.

KB5012170 Secure Boothole is already installed.

Apply Windows Security Feature Bypass in Secure Boot BootHole

"Microsoft guidance for applying Secure Boot DBX update" "boothole" "nessus scan" "none...

Windows Boothole vulnerability - how to verify if it is fixed

VLC Security Vulnerability

Will secure boot stop an installation of linux on an external ?

#AVGater vulnerability does not affect Windows Defender Antivirus