Is there a problem with the GRUB2 bootloader?

Is there a problem with the GRUB2 bootloader?

Developers in Debian and elsewhere in the Linux community have recently become aware of a severe problem in the GRUB2 bootloader that allows a bad actor to completely circumvent UEFI Secure Boot. The full details of the problem are described in Debian Security Advisory 4735.

Is there a vulnerability in GRUB2 UEFI secureboot?

GRUB2 UEFI SecureBoot vulnerability – ‘BootHole’ Developers in Debian and elsewhere in the Linux community have recently become aware of a severe problem in the GRUB2 bootloader that allows a bad actor to completely circumvent UEFI Secure Boot. The full details of the problem are described in Debian Security Advisory 4735.

Is there a way to stop GRUB2 secure boot?

Malicious actors would still be able to use older vulnerable versions of GRUB2 to be able to work around Secure Boot. To stop that, the next step will be for Microsoft to block those insecure binaries to stop them being run under SB. This is achieved using the DBX list, a feature of the UEFI Secure Boot design.

Where did boothole vulnerability in GRUB2 come from?

This vulnerability was discovered by researchers at Eclypsium and given the name BootHole . Instead of just fixing that one bug, developers have been prompted to do an in-depth audit of GRUB2’s source code. It would have been irresponsible to fix one major flaw without also looking for others!

Where can I find updated version of GRUB2?

Updated versions of Debian’s GRUB2 packages are available now via the debian-security archive for the stable Debian 10 release ( buster ). Fixed versions will be in the normal Debian archive for development versions of Debian (unstable and testing) very soon. 2. Linux

Is there a secure boot bypass in GRUB2?

While discussing the GRUB2 flaws, developers also spoke about two bypasses recently found and fixed by Jason A. Donenfeld (zx2c4) ( 1, 2 ) where Linux might also allow Secure Boot bypass. These both allow root to replace ACPI tables on a locked-down system when this should not be permitted.