Intent
The objective of this alert is to raise awareness about the vulnerability called “BootHole”. It is a global vulnerability affecting by its nature a wide range of products.
The intent of this alert is to make system administrators aware about the vulnerability and to act accordingly.
Summary
The vulnerability dubbed “BootHole” and tracked as CVE-2020-10713 affects systems running on Windows and Linux. The affected piece of software, GRUB2, is used in the most important security aspect of any device: the boot process. The “BootHole” vulnerability can be considered as a “Bootkit”.
A bootkit is a malicious program designed to load as early as possible in the boot process, in order to control all stages of the operating system start up, modifying system code and drivers before anti-virus and other security components are loaded.
Technical details
Even with secure boot enable, a threat actor could use this vulnerability to gain the ability to execute arbitrary code during the boot process. The vulnerability in itself is a buffer overflow that occurs when parsing the grub.cfg file. It happens in such a way that it bypasses signature verification as well.
Risks
Once an attacker has local or privileged access to a vulnerable device, he can load an alternative kernel (untrusted and modified) to the system, craft a malicious payload and cause a buffer overflow attack.
The highest risk is that by modifying the boot process an attacker can gain some really nasty persistence on a machine that’s really hard to detect. There is no easy way to detect this and recovery often involve completely rebuild the machine.
As for preventive solutions, there are workarounds released per brand, we will post a link to their respective advisories in the section below.
Affected Vendors and Workarounds
Microsoft https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV20...
Oracle (no workaround available)
Red Hat https://access.redhat.com/security/vulnerabilities/grub2bootloader
Canonical https://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-10713.html
SuSE https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/
Debian https://www.debian.org/security/2020/dsa-4735
Citrix (no workaround available)
VMware https://kb.vmware.com/s/article/80181
UEFI Forum https://uefi.org/revocationlistfile (updated revocation list)
HP https://support.hp.com/us-en/document/c06707446
HPE https://techhub.hpe.com/eginfolib/securityalerts/Boot_Hole/boot_hole.html
NSA https://media.defense.gov/2020/Jul/30/2002467902/-1/-1/0/CSA_MITIGATE_TH...