Bugzilla – Bug 1168994
VUL-0: CVE-2020-10713: grub2: parsing overflows can bypass secure boot restrictions
Last modified: 2023-05-11 06:50:35 UTC
CRD: 2020-08-30 or later
Taking Gary into CC. Canonical want's to blacklist older grub versions via dbx. They're asking if other distros want to do the same and if we want to share one common blacklist to prevent our shim from booting their vulnerable grub. @Gary: Do we have existing blacklist entries?
I actually went through our packages, we do not have them. I have started packaging dbxtool, that also includes the database, but they have only verison 7 out while verison 8 is tagged.
(In reply to Johannes Segitz from comment #7) > Taking Gary into CC. Canonical want's to blacklist older grub versions via > dbx. They're asking if other distros want to do the same and if we want to > share one common blacklist to prevent our shim from booting their vulnerable > grub. > > @Gary: Do we have existing blacklist entries? hmmm now I see why dbx was mentioned in some tweets and blogs suddenly. I don't think that we have the blacklist of our efi programs. If we want block grub2 through dbx, then we have to list all the hashes of released grub.efi binaries, and it probably won't be a small table. Besides, after applying the dbx list, the machine will reject all old SLE DVDs. We have to think twice on this.
Created attachment 839144 [details] embargo_disclosure20200625.pdf embargo_disclosure20200625.pdf from 25.6. Microsoft now wants our shims lists...
Created attachment 839851 [details] DBXrevocation.zip The current DBXrevocation.zip set. Interestingly, in the spreadsheet: - no redhat - canonical and debian keys - canonical shims - oracle shims The list of PESIGN hashes in there also already include several (but not all) of the SUSE shims.
10 of our shims are inthe DbX already, 3 are not.
Created attachment 840088 [details] researchers paper (there is a hole in the boot) researchers paper
Created attachment 840131 [details] grub.cfg QA REPRODUCER: grub2-emu < return > configfile grub.cfg < return > should not crash
Now public via https://eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011
SUSE-SU-2020:2073-1: An update that fixes 7 vulnerabilities is now available. Category: security (important) Bug References: 1168994,1173812,1174463,1174570 CVE References: CVE-2020-10713,CVE-2020-14308,CVE-2020-14309,CVE-2020-14310,CVE-2020-14311,CVE-2020-15706,CVE-2020-15707 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15 (src): grub2-2.02-19.48.1 SUSE Linux Enterprise Server 15-LTSS (src): grub2-2.02-19.48.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): grub2-2.02-19.48.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): grub2-2.02-19.48.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:2076-1: An update that fixes 7 vulnerabilities is now available. Category: security (important) Bug References: 1084632,1168994,1173812,1174463,1174570 CVE References: CVE-2020-10713,CVE-2020-14308,CVE-2020-14309,CVE-2020-14310,CVE-2020-14311,CVE-2020-15706,CVE-2020-15707 JIRA References: Sources used: SUSE OpenStack Cloud 7 (src): grub2-2.02~beta2-115.49.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): grub2-2.02~beta2-115.49.1 SUSE Linux Enterprise Server 12-SP2-LTSS (src): grub2-2.02~beta2-115.49.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): grub2-2.02~beta2-115.49.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:2079-1: An update that fixes 7 vulnerabilities is now available. Category: security (important) Bug References: 1084632,1168994,1173812,1174463,1174570 CVE References: CVE-2020-10713,CVE-2020-14308,CVE-2020-14309,CVE-2020-14310,CVE-2020-14311,CVE-2020-15706,CVE-2020-15707 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 8 (src): grub2-2.02-4.53.1 SUSE OpenStack Cloud 8 (src): grub2-2.02-4.53.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): grub2-2.02-4.53.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): grub2-2.02-4.53.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): grub2-2.02-4.53.1 SUSE Enterprise Storage 5 (src): grub2-2.02-4.53.1 HPE Helion Openstack 8 (src): grub2-2.02-4.53.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:2078-1: An update that fixes 7 vulnerabilities is now available. Category: security (important) Bug References: 1168994,1173812,1174463,1174570 CVE References: CVE-2020-10713,CVE-2020-14308,CVE-2020-14309,CVE-2020-14310,CVE-2020-14311,CVE-2020-15706,CVE-2020-15707 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): grub2-2.02-12.31.1 SUSE OpenStack Cloud 9 (src): grub2-2.02-12.31.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): grub2-2.02-12.31.1 SUSE Linux Enterprise Server 12-SP5 (src): grub2-2.02-12.31.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): grub2-2.02-12.31.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:2074-1: An update that fixes 7 vulnerabilities is now available. Category: security (important) Bug References: 1168994,1173812,1174463,1174570 CVE References: CVE-2020-10713,CVE-2020-14308,CVE-2020-14309,CVE-2020-14310,CVE-2020-14311,CVE-2020-15706,CVE-2020-15707 JIRA References: Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP2 (src): grub2-2.04-9.7.1 SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): grub2-2.04-9.7.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:2077-1: An update that fixes 7 vulnerabilities is now available. Category: security (important) Bug References: 1168994,1173812,1174463,1174570 CVE References: CVE-2020-10713,CVE-2020-14308,CVE-2020-14309,CVE-2020-14310,CVE-2020-14311,CVE-2020-15706,CVE-2020-15707 JIRA References: Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP1 (src): grub2-2.02-26.25.1 SUSE Linux Enterprise Module for Basesystem 15-SP1 (src): grub2-2.02-26.25.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:14440-1: An update that fixes 7 vulnerabilities is now available. Category: security (important) Bug References: 1084632,1168994,1173812,1174463,1174570 CVE References: CVE-2020-10713,CVE-2020-14308,CVE-2020-14309,CVE-2020-14310,CVE-2020-14311,CVE-2020-15706,CVE-2020-15707 JIRA References: Sources used: SUSE Linux Enterprise Server 11-SP4-LTSS (src): grub2-2.00-0.66.15.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): grub2-2.00-0.66.15.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
This is an autogenerated message for OBS integration: This bug (1168994) was mentioned in https://build.opensuse.org/request/show/824278 15.2 / shim
openSUSE-SU-2020:1168-1: An update that fixes 7 vulnerabilities is now available. Category: security (important) Bug References: 1168994,1173812,1174463,1174570 CVE References: CVE-2020-10713,CVE-2020-14308,CVE-2020-14309,CVE-2020-14310,CVE-2020-14311,CVE-2020-15706,CVE-2020-15707 JIRA References: Sources used: openSUSE Leap 15.1 (src): grub2-2.02-lp151.21.21.4
openSUSE-SU-2020:1169-1: An update that fixes 7 vulnerabilities is now available. Category: security (important) Bug References: 1168994,1173812,1174463,1174570 CVE References: CVE-2020-10713,CVE-2020-14308,CVE-2020-14309,CVE-2020-14310,CVE-2020-14311,CVE-2020-15706,CVE-2020-15707 JIRA References: Sources used: openSUSE Leap 15.2 (src): grub2-2.04-lp152.7.3.4
This is an autogenerated message for OBS integration: This bug (1168994) was mentioned in https://build.opensuse.org/request/show/828869 15.2 / shim
The patch has been submitted so changing the status accordingly.
Please reassign completed bugs to security-team@suse.de
openSUSE-RU-2020:1274-1: An update that has 9 recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1113225,1121268,1153953,1168104,1168994,1173411,1174320,1175626,1175656 CVE References: JIRA References: Sources used: openSUSE Leap 15.2 (src): shim-15+git47-lp152.4.5.1
Resolved.
SUSE-SU-2020:2629-1: An update that solves one vulnerability and has 8 fixes is now available. Category: security (moderate) Bug References: 1113225,1121268,1153953,1168104,1168994,1173411,1174320,1175626,1175656 CVE References: CVE-2020-10713 JIRA References: Sources used: SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): shim-15+git47-3.8.1 SUSE Linux Enterprise Module for Basesystem 15-SP1 (src): shim-15+git47-3.8.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:2628-1: An update that solves one vulnerability and has two fixes is now available. Category: security (moderate) Bug References: 1168994,1175626,1175656 CVE References: CVE-2020-10713 JIRA References: Sources used: SUSE OpenStack Cloud 7 (src): shim-15+git47-22.8.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): shim-15+git47-22.8.1 SUSE Linux Enterprise Server 12-SP2-LTSS (src): shim-15+git47-22.8.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): shim-15+git47-22.8.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:2626-1: An update that solves one vulnerability and has two fixes is now available. Category: security (moderate) Bug References: 1168994,1175626,1175656 CVE References: CVE-2020-10713 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15 (src): shim-15+git47-7.15.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): shim-15+git47-7.15.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): shim-15+git47-7.15.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:2627-1: An update that solves one vulnerability and has two fixes is now available. Category: security (moderate) Bug References: 1168994,1175626,1175656 CVE References: CVE-2020-10713 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): shim-15+git47-25.11.1 SUSE OpenStack Cloud Crowbar 8 (src): shim-15+git47-25.11.1 SUSE OpenStack Cloud 9 (src): shim-15+git47-25.11.1 SUSE OpenStack Cloud 8 (src): shim-15+git47-25.11.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): shim-15+git47-25.11.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): shim-15+git47-25.11.1 SUSE Linux Enterprise Server 12-SP5 (src): shim-15+git47-25.11.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): shim-15+git47-25.11.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): shim-15+git47-25.11.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): shim-15+git47-25.11.1 SUSE Enterprise Storage 5 (src): shim-15+git47-25.11.1 HPE Helion Openstack 8 (src): shim-15+git47-25.11.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:14490-1: An update that solves one vulnerability and has two fixes is now available. Category: security (moderate) Bug References: 1168994,1175626,1175656 CVE References: CVE-2020-10713 JIRA References: Sources used: SUSE Linux Enterprise Server 11-SP4-LTSS (src): shim-15+git47-12.5.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
*** Bug 1199353 has been marked as a duplicate of this bug. ***