Security update for keyboard input vulnerability.
- Fix security issue when reading username and password Related: CVE-2015-8370 - Do a better job of handling GRUB2_PASSWORD Related: rhbz#1284370 Signed-off-by: Peter Jones <pjones@redhat.com>
This commit is contained in:
Peter Jones
Björn Esser
parent
d979a79ed2
commit
bf8e18bc1d
2
.gitignore
vendored
2
.gitignore
vendored
@ -4,3 +4,5 @@ clog
|
||||
/unifont-5.1.20080820.pcf.gz
|
||||
/theme.tar.bz2
|
||||
kojilogs
|
||||
/grub-*/
|
||||
.build*.log
|
||||
|
||||
@ -0,0 +1,47 @@
|
||||
From b059b6f9c7d236e83829689a1615f180f230baaa Mon Sep 17 00:00:00 2001
|
||||
From: Hector Marco-Gisbert <hecmargi@upv.es>
|
||||
Date: Fri, 13 Nov 2015 16:21:09 +0100
|
||||
Subject: [PATCH 75/76] Fix security issue when reading username and password
|
||||
|
||||
This patch fixes two integer underflows at:
|
||||
* grub-core/lib/crypto.c
|
||||
* grub-core/normal/auth.c
|
||||
|
||||
Resolves: CVE-2015-8370
|
||||
|
||||
Signed-off-by: Hector Marco-Gisbert <hecmargi@upv.es>
|
||||
Signed-off-by: Ismael Ripoll-Ripoll <iripoll@disca.upv.es>
|
||||
---
|
||||
grub-core/lib/crypto.c | 2 +-
|
||||
grub-core/normal/auth.c | 2 +-
|
||||
2 files changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/grub-core/lib/crypto.c b/grub-core/lib/crypto.c
|
||||
index 010e550..524a3d8 100644
|
||||
--- a/grub-core/lib/crypto.c
|
||||
+++ b/grub-core/lib/crypto.c
|
||||
@@ -468,7 +468,7 @@ grub_password_get (char buf[], unsigned buf_size)
|
||||
break;
|
||||
}
|
||||
|
||||
- if (key == '\b')
|
||||
+ if (key == '\b' && cur_len)
|
||||
{
|
||||
cur_len--;
|
||||
continue;
|
||||
diff --git a/grub-core/normal/auth.c b/grub-core/normal/auth.c
|
||||
index c6bd96e..5782ec5 100644
|
||||
--- a/grub-core/normal/auth.c
|
||||
+++ b/grub-core/normal/auth.c
|
||||
@@ -172,7 +172,7 @@ grub_username_get (char buf[], unsigned buf_size)
|
||||
break;
|
||||
}
|
||||
|
||||
- if (key == '\b')
|
||||
+ if (key == '\b' && cur_len)
|
||||
{
|
||||
cur_len--;
|
||||
grub_printf ("\b");
|
||||
--
|
||||
2.5.0
|
||||
|
||||
44
0076-01_users-Handle-GRUB_PASSWORD-better.patch
Normal file
44
0076-01_users-Handle-GRUB_PASSWORD-better.patch
Normal file
@ -0,0 +1,44 @@
|
||||
From e5e933f4fd449301fc1856db31ef1167b4867cd1 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Jones <pjones@redhat.com>
|
||||
Date: Fri, 4 Dec 2015 09:28:38 -0500
|
||||
Subject: [PATCH 76/76] 01_users: Handle GRUB_PASSWORD better.
|
||||
|
||||
Only handle GRUB2_PASSWORD not GRUB_PASSWORD.
|
||||
|
||||
Related: rhbz#1284370
|
||||
|
||||
Signed-off-by: Peter Jones <pjones@redhat.com>
|
||||
---
|
||||
util/grub-setpassword.8 | 2 +-
|
||||
util/grub.d/01_users.in | 2 +-
|
||||
2 files changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/util/grub-setpassword.8 b/util/grub-setpassword.8
|
||||
index 5973abe..49200a8 100644
|
||||
--- a/util/grub-setpassword.8
|
||||
+++ b/util/grub-setpassword.8
|
||||
@@ -9,7 +9,7 @@
|
||||
\fBgrub-setpassword\fR outputs the user.cfg file which contains the hashed GRUB bootloader password. This utility only supports configurations where there is a single root user.
|
||||
|
||||
The file has the format:
|
||||
-GRUB_2PASSWORD=<\fIhashed password\fR>.
|
||||
+GRUB2_PASSWORD=<\fIhashed password\fR>.
|
||||
|
||||
.SH OPTIONS
|
||||
.TP
|
||||
diff --git a/util/grub.d/01_users.in b/util/grub.d/01_users.in
|
||||
index facd409..db2f44b 100644
|
||||
--- a/util/grub.d/01_users.in
|
||||
+++ b/util/grub.d/01_users.in
|
||||
@@ -2,7 +2,7 @@
|
||||
cat << EOF
|
||||
if [ -f \${prefix}/user.cfg ]; then
|
||||
source \${prefix}/user.cfg
|
||||
- if [ -n \${GRUB2_PASSWORD} ]; then
|
||||
+ if [ -n "\${GRUB2_PASSWORD}" ]; then
|
||||
set superusers="root"
|
||||
export superusers
|
||||
password_pbkdf2 root \${GRUB2_PASSWORD}
|
||||
--
|
||||
2.5.0
|
||||
|
||||
38
grub2.spec
38
grub2.spec
@ -45,7 +45,7 @@
|
||||
Name: grub2
|
||||
Epoch: 1
|
||||
Version: 2.02
|
||||
Release: 0.24%{?dist}
|
||||
Release: 0.25%{?dist}
|
||||
Summary: Bootloader with support for Linux, Multiboot and more
|
||||
|
||||
Group: System Environment/Base
|
||||
@ -138,6 +138,8 @@ Patch0071: 0071-Make-exit-take-a-return-code.patch
|
||||
Patch0072: 0072-Add-some-__unused__-where-gcc-5.x-is-more-picky-abou.patch
|
||||
Patch0073: 0073-Fix-race-in-EFI-validation.patch
|
||||
Patch0074: 0074-Mark-po-exclude.pot-as-binary-so-git-won-t-try-to-di.patch
|
||||
Patch0075: 0075-Fix-security-issue-when-reading-username-and-passwor.patch
|
||||
Patch0076: 0076-01_users-Handle-GRUB_PASSWORD-better.patch
|
||||
|
||||
|
||||
|
||||
@ -467,6 +469,34 @@ cp -a ${RPM_BUILD_ROOT}/usr/sbin %{finddebugroot}/usr/sbin
|
||||
%clean
|
||||
rm -rf $RPM_BUILD_ROOT
|
||||
|
||||
%pre tools
|
||||
if [ -f /boot/grub2/user.cfg ]; then
|
||||
if grep -q '^GRUB_PASSWORD=' /boot/grub2/user.cfg ; then
|
||||
sed -i 's/^GRUB_PASSWORD=/GRUB2_PASSWORD=/' /boot/grub2/user.cfg
|
||||
fi
|
||||
elif [ -f /boot/efi/EFI/%{efidir}/user.cfg ]; then
|
||||
if grep -q '^GRUB_PASSWORD=' /boot/efi/EFI/%{efidir}/user.cfg ; then
|
||||
sed -i 's/^GRUB_PASSWORD=/GRUB2_PASSWORD=/' \
|
||||
/boot/efi/EFI/%{efidir}/user.cfg
|
||||
fi
|
||||
elif [ -f /etc/grub.d/01_users ] && \
|
||||
grep -q '^password_pbkdf2 root' /etc/grub.d/01_users ; then
|
||||
if [ -f /boot/efi/EFI/%{efidir}/grub.cfg ]; then
|
||||
# on EFI we don't get permissions on the file, but
|
||||
# the directory is protected.
|
||||
grep '^password_pbkdf2 root' /etc/grub.d/01_users | \
|
||||
sed 's/^password_pbkdf2 root \(.*\)$/GRUB2_PASSWORD=\1/' \
|
||||
> /boot/efi/EFI/%{efidir}/user.cfg
|
||||
fi
|
||||
if [ -f /boot/grub2/grub.cfg ]; then
|
||||
install -m 0600 /dev/null /boot/grub2/user.cfg
|
||||
chmod 0600 /boot/grub2/user.cfg
|
||||
grep '^password_pbkdf2 root' /etc/grub.d/01_users | \
|
||||
sed 's/^password_pbkdf2 root \(.*\)$/GRUB2_PASSWORD=\1/' \
|
||||
> /boot/grub2/user.cfg
|
||||
fi
|
||||
fi
|
||||
|
||||
%post tools
|
||||
if [ "$1" = 1 ]; then
|
||||
/sbin/install-info --info-dir=%{_infodir} %{_infodir}/%{name}.info.gz || :
|
||||
@ -596,6 +626,12 @@ fi
|
||||
%{_datarootdir}/grub/themes/starfield
|
||||
|
||||
%changelog
|
||||
* Thu Dec 10 2015 Peter Jones <pjones@redhat.com> - 2.02-0.25
|
||||
- Fix security issue when reading username and password
|
||||
Related: CVE-2015-8370
|
||||
- Do a better job of handling GRUB2_PASSWORD
|
||||
Related: rhbz#1284370
|
||||
|
||||
* Fri Nov 20 2015 Peter Jones <pjones@redhat.com> - 2.02-0.24
|
||||
- Rebuild without multiboot* modules in the EFI image.
|
||||
Related: rhbz#1264103
|
||||
|
||||
Loading…
Reference in New Issue
Block a user