grub2 package is vulnerable to CVE-2020-14372, CVE-2020-25632, CVE-2020-25647, CVE-2020-27749, CVE-2020-27779, CVE-2021-20225, CVE-2021-20233 and CVE-2021-3418

OpenSubmitted by Léo Le Bouter.
Details
3 participants
  • Leo Famulari
  • Léo Le Bouter
  • Mark H Weaver
Owner
unassigned
Severity
normal
L
L
Léo Le Bouter wrote on 16 Mar 09:08 +0100
(address . bug-guix@gnu.org)
ba69ba4020b40dfa182174ea2395cf17195512d5.camel@zaclys.net
As outlined by https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass2021we have a new wave of GRUB security vulnerabilities around SecureBoot.
There is no new upstream release so patching this appears to be somekind of sport.
Debian has patched it in this commit: https://salsa.debian.org/grub-team/grub/-/commit/37c2a594625efba8b7f10d18a444393982d2e31f
I see also there's a new concept of SBAT section to ease administrativeefforts around certificate revocation when signed binaries such as someGRUB2 things become vulnerable (and we don't want them to verifysuccessfully anymore).
This looks like a sizeable upgrade to a sensitive part of GNU Guix, sowe have to test carefully.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEFIvLi9gL+xax3g6RRaix6GvNEKYFAmBQZ38ACgkQRaix6GvNEKZD9xAAphY8xFLTczFCZLKoZw4UkFsvMLHdiarD/RoDWFzATRHJqB/vN9chAXfkOu56B6qOKtGwevwSlvCNXx9fSQS90Ae3h5HqyqZDgO5I3AVQPcXEYeylgngV18NGexh0Vzmyd+Ue8mBpFKcLTuph3C5WffJXgFGpGZBcoMlSLOMVGAUKxY8uQLCAoaN1CsBuIKFV+5kAbK+H480UVanpudMFuzPadWHXlwRbV/uPMDQL5FuFlRQ+ZDbKZQjJFdnoR0bKFRfYHofqf/EflEX3V0kYkUI/Kk0uzoEtGfiUVE/iS8r0s2sCvPII7Her374GCS06zzIguMPtqiO7ikg0oJtJ2I+C9WTfYvZe3bKTRXUXdYUPuTwqQVd9uyuQQP4w5wwTCvidJ7iYZoA5Vk27Cs6JnOsds8PG7b4nQhSluATiVckOGz50H1G8SOlEgnVEuxT6NIqYYtYOLFJfmNTIU4hnKKwSun3DMxr5UgL54M/MnoWrCCPiFO6R8GMRbICsP59N9EqKGaoYtAxjOdKIQnBT2NBnBcmsGVhakDnS34OX5dd54w2sFjZkSgkKRx20A4bg1ODwRJkrICRuhDagg8P47SiovFxQzjiXA3Va1we06yCxpzUXsIK9SyH8WhEhxgAoh+pi37K4fTj76Tj+NODwYICuTwWx5A0Me5/DrPqkltk==f/yr-----END PGP SIGNATURE-----

L
L
Léo Le Bouter wrote on 16 Mar 09:16 +0100
(address . 47185@debbugs.gnu.org)
167a5c8e8451729bc50b530229ca34a832af7530.camel@zaclys.net
On Tue, 2021-03-16 at 09:08 +0100, Léo Le Bouter via Bug reports forGNU Guix wrote:
Toggle quote (3 lines)> There is no new upstream release so patching this appears to be some> kind of sport.
There seems to be a release candidate available: https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00219.html
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEFIvLi9gL+xax3g6RRaix6GvNEKYFAmBQaXkACgkQRaix6GvNEKbXcw/+MU6e2edC+EE2beNfVxKyO3v5w47chk0TZeF/XA14kE9ZKjRPSUXhi+MSIPbbGlqd7HbQKmaX202ItSRvG7iaAo7pWzH0/q9vyTte4veUftJ7TTE1N7UYh4KQiAilEG12KY81g0NGIZkU8J1m7oNw4CvL6yG/jQL58zomtSx2godaVu9UEdrFYvxHFWUJ3sqN9Qj05NM2jx4u/+LVfbvU9ixW5sFxzyivKVPxTDNG5CD3D0m3yrsZOvJPTFfedbKisa9Zw/f4skEjNt7ceZT+7YqxPohe6inJch6OJG7phkQRVUsiC8oWCxedtmNU42qrVed4L76CWirV9m3Xw+ingsaJw5hfVSf8vVE4Pi4YOnwWopBpTFlsV5mQcLqRDX2NQ1R/tnXi4JfZb5SV0l8CWKc19N9GloJkGeKo+krzKN9tocM2A0JVnX71YlTVMiEoSKQc2a667o6/80P5XRg8lXYRDhFA/tH/YzgF8U/kwhIfvdGpFNFUv/uVFHjGFhpF5mmfh8gIC4fKyZQoSKuUwpRFB7vj5/saseIQmGQJyfgUn0lPenb0UGRww5MWlpCwAncmd35urHRMpBEpNC+Spo2G64gnAQHeB/QH7B4xfk/Un7bMzAobrK+BgJpaBiJflbZp5wHmpA/JD92dZYoKpjHWbAMICUBZmzR891y4Zuc==y8Jo-----END PGP SIGNATURE-----

L
L
Léo Le Bouter wrote on 16 Mar 09:36 +0100
(address . 47185@debbugs.gnu.org)
3de2a6393156da40334d95993e15b22ca0eae5df.camel@zaclys.net
NOTE: SecureBoot on GNU Guix is not something common at all, so theurgency to fix this issue is not as great as if we explicitlyadvertised support for SecureBoot.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEFIvLi9gL+xax3g6RRaix6GvNEKYFAmBQbhQACgkQRaix6GvNEKZykg//SI+lx2UdH/BigTfKPTCC8W+HY2hB1Af+EfxrMRP2aeYubM0R8D1qeHE8GtLb37rFWF2IVD3A08CiOIDlrzQqvRaTefvwuXl8G1DiaCN16/AiVRBl56p0o6KY6ihNk4EssaTgsEK6G9vdfM+oLsSaGY8jpRr3nz1jnjz/mzl8URYMjKVm/Cp6Mwys6NGKquG6QSe4GrxNolrzNNhhkdi6VzluIqn60SBN8bMhSRv6+pLFtdvBX7SPLG7VBPyoa+oJsJVS3wojBnnIeDK+3Ha0NihuKSCexyoZ67sqWXhNfMWne7259kFbFDD1dm6MjqIhWsNVUnOtTpsGPFcEDCrUl4jmw4DpJavKB2yP3ViTGNrS34IbDJztXXshg+/29n6b9NgsXqljrJuu9v75UuGtAo2Z6yJafTL0zrav7HcziKtQFJG1bEMn5XjgN8kNoAUOE6NIml2YradplPyo9H0VOZTYS0g2dkaJN3OENmOz9rxa0LQTAYSxLXZCnE0ZHvauSqKun4FgHcz/ui9bGpkL1tnwcEtVCwMttYFD6bOx1DVh29vbKhnAmXHdMWBi+gNjX5R8iLbGGtDRr0rItjNRN4q+BYmySRI6fyAh4Tl8HMKfLz+ogxWDaO/Ic94WUg8dbtmCepxVNZM6GpaDYm1H8pZFE3bomMOoVprfiQwxW+s==codz-----END PGP SIGNATURE-----

M
M
Mark H Weaver wrote on 17 Mar 00:47 +0100
87pmzyirt1.fsf@netris.org
Hi Léo,
Léo Le Bouter via Bug reports for GNU Guix <bug-guix@gnu.org> writes:
Toggle quote (4 lines)> NOTE: SecureBoot on GNU Guix is not something common at all, so the> urgency to fix this issue is not as great as if we explicitly> advertised support for SecureBoot.
I would go further and question whether *anyone* is using SecureBootwith a Guix system, and moreover whether its feasible to do withoutnon-trivial development work.
Toggle quote (3 lines)> This looks like a sizeable upgrade to a sensitive part of GNU Guix, so> we have to test carefully.
Indeed. I would like to underline this point: GRUB is the only part ofa Guix system that cannot be easily rolled back if it breaks. If wemake changes to GRUB that causes breakage for some minority of users,those users could end up with an unbootable system, requiring the use ofa rescue disk to repair.
Therefore, we should be *very* careful about updating our GRUB package,especially for the sake of bugs that almost certainly do not affect Guixusers.
I think we should refrain from updating GRUB until there's an officialupstream stable release. Even then, I would advise making an effort totest it on Guix systems, using several different system configurations,before pushing it to 'master'.
What do you think?
Regards, Mark
L
L
Leo Famulari wrote on 17 Mar 03:15 +0100
(name . Mark H Weaver)(address . mhw@netris.org)
YFFmPgweFmoXEuSx@jasmine.lan
On Tue, Mar 16, 2021 at 07:47:43PM -0400, Mark H Weaver wrote:
Toggle quote (7 lines)> I think we should refrain from updating GRUB until there's an official> upstream stable release. Even then, I would advise making an effort to> test it on Guix systems, using several different system configurations,> before pushing it to 'master'.> > What do you think?
I agree with Mark that we should tread carefully. Also, I am alwaysavailable to test GRUB changes. I have a computer dedicated to testingchanges with Guix System.
L
L
Léo Le Bouter wrote on 19 Mar 11:29 +0100
(address . control@debbugs.gnu.org)
35e9d8fb5e5caacb8abac2ead7742d7ccd9ee737.camel@zaclys.net
tags 47185 + securityquit
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEFIvLi9gL+xax3g6RRaix6GvNEKYFAmBUfRUACgkQRaix6GvNEKZyzxAAokqeecxL5GW9yJv0n8HivE2gkNvrkr3rIDqMqwXc/SIWvULMkZpgjLDgcl2X2w+EjQpXjqgaNdK1wuHq5HHHDQ+vDio6tOq3HgFbD51gRTDwmYGt6mSdM2ji2ndUlD9uhteZ/ZOl7pJJ13t/woj+qh3dlCRyMeba9pz6emRGWoHaxPA9Uftltv0nhhAxkiGVQPzcw6i0xrKkzOH26HQYrGV8ygIt9bgcO2dD6EggfHo+yRPX6u6BPcAU2HQmgtChioJYmGlBP2V17/frhiuhqH0OVykaYrMNjBo2Z+/cEAvNReuW6PSfmKVFsaVYeFanPPgYOPM7P8XXaJCX43I2mgjT98W+lamUb3L4653ahl/St8rjv9fTVfHKPPmFfA+p5lUjZgZrwL93q7rAoSSV/VrPBklzFjH9xrcQXkRPb2CNkggMFP18h/kNM9Hl/TGTpWaiws4DuEPA6LbJRiR86Y13QT87+5Nu0VnA7qNynH3Xy7YWZmaC42K0LCLtxp07FXgopeh+4hgbxUAXo/gXMFutaEhwsSxqih9ljEr5kZoX7FFkKMoCz74LKcLrs+y4rH6R3RV0TyIpa/iJ4VcyLttZrw1G8DHUtyXgS2u0NCoCUVn8YB1uIdN7EzzSs8PdnHPHnOOrcf6f6qJTLHBd44AipFABBu/e8IPlZFWGtQM==AihY-----END PGP SIGNATURE-----

?