grub2 package is vulnerable to CVE-2020-14372, CVE-2020-25632, CVE-2020-25647, CVE-2020-27749, CVE-2020-27779, CVE-2021-20225, CVE-2021-20233 and CVE-2021-3418

Léo Le Bouter wrote on 16 Mar 2021 09:08

Recipients:(address . bug-guix@gnu.org)

Message-ID:ba69ba4020b40dfa182174ea2395cf17195512d5.camel@zaclys.net

As outlined by

https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass2021

we have a new wave of GRUB security vulnerabilities around SecureBoot.

There is no new upstream release so patching this appears to be some

kind of sport.

Debian has patched it in this commit:

https://salsa.debian.org/grub-team/grub/-/commit/37c2a594625efba8b7f10d18a444393982d2e31f

I see also there's a new concept of SBAT section to ease administrative

efforts around certificate revocation when signed binaries such as some

GRUB2 things become vulnerable (and we don't want them to verify

successfully anymore).

This looks like a sizeable upgrade to a sensitive part of GNU Guix, so

we have to test carefully.

Léo Le Bouter wrote on 16 Mar 2021 09:16

Recipients:(address . 47185@debbugs.gnu.org)

Message-ID:167a5c8e8451729bc50b530229ca34a832af7530.camel@zaclys.net

On Tue, 2021-03-16 at 09:08 +0100, Léo Le Bouter via Bug reports for

GNU Guix wrote:

Toggle quote (3 lines)

> There is no new upstream release so patching this appears to be some

> kind of sport.

There seems to be a release candidate available:

https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00219.html

Léo Le Bouter wrote on 16 Mar 2021 09:36

Recipients:(address . 47185@debbugs.gnu.org)

Message-ID:3de2a6393156da40334d95993e15b22ca0eae5df.camel@zaclys.net

NOTE: SecureBoot on GNU Guix is not something common at all, so the
urgency to fix this issue is not as great as if we explicitly
advertised support for SecureBoot.

Mark H Weaver wrote on 17 Mar 2021 00:47

Recipients:

Message-ID:87pmzyirt1.fsf@netris.org

Hi Léo,

Léo Le Bouter via Bug reports for GNU Guix <bug-guix@gnu.org> writes:

Toggle quote (4 lines)

> NOTE: SecureBoot on GNU Guix is not something common at all, so the

> urgency to fix this issue is not as great as if we explicitly

> advertised support for SecureBoot.

I would go further and question whether *anyone* is using SecureBoot

with a Guix system, and moreover whether its feasible to do without

non-trivial development work.

Toggle quote (3 lines)

> This looks like a sizeable upgrade to a sensitive part of GNU Guix, so

> we have to test carefully.

Indeed. I would like to underline this point: GRUB is the only part of

a Guix system that cannot be easily rolled back if it breaks. If we

make changes to GRUB that causes breakage for some minority of users,

those users could end up with an unbootable system, requiring the use of

a rescue disk to repair.

Therefore, we should be *very* careful about updating our GRUB package,

especially for the sake of bugs that almost certainly do not affect Guix

users.

I think we should refrain from updating GRUB until there's an official

upstream stable release. Even then, I would advise making an effort to

test it on Guix systems, using several different system configurations,

before pushing it to 'master'.

What do you think?

Regards,

Mark

Leo Famulari wrote on 17 Mar 2021 03:15

Recipients:(name . Mark H Weaver)(address . mhw@netris.org)

Message-ID:YFFmPgweFmoXEuSx@jasmine.lan

On Tue, Mar 16, 2021 at 07:47:43PM -0400, Mark H Weaver wrote:

Toggle quote (7 lines)

> I think we should refrain from updating GRUB until there's an official

> upstream stable release. Even then, I would advise making an effort to

> test it on Guix systems, using several different system configurations,

> before pushing it to 'master'.

> What do you think?

I agree with Mark that we should tread carefully. Also, I am always
available to test GRUB changes. I have a computer dedicated to testing
changes with Guix System.

Léo Le Bouter wrote on 19 Mar 2021 11:29

Recipients:(address . control@debbugs.gnu.org)

Message-ID:35e9d8fb5e5caacb8abac2ead7742d7ccd9ee737.camel@zaclys.net

tags 47185 + security

quit

Maxim Cournoyer wrote on 23 Mar 04:32 +0100

Recipients:(name . Léo Le Bouter)(address . lle-bout@zaclys.net)(address . 47185-done@debbugs.gnu.org)

Message-ID:87r16txs0t.fsf@gmail.com

Hello,

I'm closing this, since we're now using GRUB 2.06, released in June of

last year.

Thank you,

Maxim

Closed

Your comment

This issue is archived.

To comment on this conversation send email to 47185@debbugs.gnu.org

is:open	open issues
is:done	closed issues
submitter:<who>	search issue submitter
author:<who>	search by message author
date:yesterday..now	search by issue date
mdate:3m..2d	search by message date