Bugzilla – Bug 1198495
VUL-0: CVE-2022-28735: grub2: verifier framework changes
Last modified: 2023-01-11 15:46:04 UTC
From fa61ad69861c1cb3f68bf853d78fae7fd93986a0 Mon Sep 17 00:00:00 2001 From: Julian Andres Klode <julian.klode@canonical.com> Date: Thu, 2 Dec 2021 15:03:53 +0100 Subject: [PATCH 04/31] kern/efi/sb: Reject non-kernel files in the shim_lock verifier We must not allow other verifiers to pass things like the GRUB modules. Instead of maintaining a blocklist, maintain an allowlist of things that we do not care about. This allowlist really should be made reusable, and shared by the lockdown verifier, but this is the minimal patch addressing security concerns where the TPM verifier was able to mark modules as verified (or the OpenPGP verifier for that matter), when it should not do so on shim-powered secure boot systems. Fixes: CVE-2022-28735
Created attachment 858162 [details] 0004-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch 0004-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
CRD: 2022-05-24
This CVE is only applicable to grub-2.04 and newer where there's verifier framework support. That means SLE versions less than SLE-15-SP1 is not required to fix the CVE as they are all staying on grub-2.02. The SLE needs this CVE fix will be: SLE-15-SP2 (2.04) SLE-15-SP3 (2.04) SLE-15-SP4 (2.06)
New CRD was set to allow shim code to be ready. CRD: 2022-06-07 10:00PT
public now
SUSE-SU-2022:2035-1: An update that solves 7 vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1191184,1191185,1191186,1193282,1197948,1198460,1198493,1198495,1198496,1198581 CVE References: CVE-2021-3695,CVE-2021-3696,CVE-2021-3697,CVE-2022-28733,CVE-2022-28734,CVE-2022-28735,CVE-2022-28736 JIRA References: Sources used: openSUSE Leap 15.4 (src): grub2-2.06-150400.11.5.2 SUSE Linux Enterprise Module for Server Applications 15-SP4 (src): grub2-2.06-150400.11.5.2 SUSE Linux Enterprise Module for SUSE Manager Proxy 4.3 (src): grub2-2.06-150400.11.5.2 SUSE Linux Enterprise Module for Basesystem 15-SP4 (src): grub2-2.06-150400.11.5.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:2064-1: An update that solves 7 vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1191184,1191185,1191186,1193282,1197948,1198460,1198493,1198495,1198496,1198581 CVE References: CVE-2021-3695,CVE-2021-3696,CVE-2021-3697,CVE-2022-28733,CVE-2022-28734,CVE-2022-28735,CVE-2022-28736 JIRA References: Sources used: openSUSE Leap 15.3 (src): grub2-2.04-150300.22.20.2 SUSE Linux Enterprise Module for Server Applications 15-SP3 (src): grub2-2.04-150300.22.20.2 SUSE Linux Enterprise Module for SUSE Manager Proxy 4.2 (src): grub2-2.04-150300.22.20.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): grub2-2.04-150300.22.20.2 SUSE Linux Enterprise Micro 5.2 (src): grub2-2.04-150300.22.20.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:2074-1: An update that solves 7 vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1191184,1191185,1191186,1193282,1197948,1198460,1198493,1198495,1198496,1198581 CVE References: CVE-2021-3695,CVE-2021-3696,CVE-2021-3697,CVE-2022-28733,CVE-2022-28734,CVE-2022-28735,CVE-2022-28736 JIRA References: Sources used: SUSE Manager Server 4.1 (src): grub2-2.04-150200.9.63.2 SUSE Manager Retail Branch Server 4.1 (src): grub2-2.04-150200.9.63.2 SUSE Manager Proxy 4.1 (src): grub2-2.04-150200.9.63.2 SUSE Linux Enterprise Server for SAP 15-SP2 (src): grub2-2.04-150200.9.63.2 SUSE Linux Enterprise Server 15-SP2-LTSS (src): grub2-2.04-150200.9.63.2 SUSE Linux Enterprise Server 15-SP2-BCL (src): grub2-2.04-150200.9.63.2 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src): grub2-2.04-150200.9.63.2 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src): grub2-2.04-150200.9.63.2 SUSE Enterprise Storage 7 (src): grub2-2.04-150200.9.63.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:2073-1: An update that solves 7 vulnerabilities and has 14 fixes is now available. Category: security (important) Bug References: 1071559,1159205,1179981,1189769,1189874,1191184,1191185,1191186,1191504,1191974,1192522,1192622,1193282,1193532,1195204,1197948,1198460,1198493,1198495,1198496,1198581 CVE References: CVE-2021-3695,CVE-2021-3696,CVE-2021-3697,CVE-2022-28733,CVE-2022-28734,CVE-2022-28735,CVE-2022-28736 JIRA References: Sources used: SUSE Linux Enterprise Micro 5.1 (src): grub2-2.04-150300.3.5.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Bulk-re-assigning to the new bootloader-maintainers@suse.de group.
done, fixed