Bug 1198495 - (CVE-2022-28735) VUL-0: CVE-2022-28735: grub2: verifier framework changes
(CVE-2022-28735)
VUL-0: CVE-2022-28735: grub2: verifier framework changes
Status: NEW
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Bootloader Maintainers
Security Team bot
https://smash.suse.de/issue/329065/
CVSSv3.1:SUSE:CVE-2022-28735:8.4:(AV:...
:
Depends on:
Blocks: 1198581
  Show dependency treegraph
 
Reported: 2022-04-14 14:39 UTC by Marcus Meissner
Modified: 2022-07-28 12:28 UTC (History)
3 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
0004-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch (3.54 KB, patch)
2022-04-14 14:39 UTC, Marcus Meissner
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Marcus Meissner 2022-04-14 14:39:43 UTC
From fa61ad69861c1cb3f68bf853d78fae7fd93986a0 Mon Sep 17 00:00:00 2001
From: Julian Andres Klode <julian.klode@canonical.com>
Date: Thu, 2 Dec 2021 15:03:53 +0100
Subject: [PATCH 04/31] kern/efi/sb: Reject non-kernel files in the shim_lock
 verifier

We must not allow other verifiers to pass things like the GRUB modules.
Instead of maintaining a blocklist, maintain an allowlist of things
that we do not care about.

This allowlist really should be made reusable, and shared by the
lockdown verifier, but this is the minimal patch addressing
security concerns where the TPM verifier was able to mark modules
as verified (or the OpenPGP verifier for that matter), when it
should not do so on shim-powered secure boot systems.

Fixes: CVE-2022-28735
Comment 2 Marcus Meissner 2022-04-14 14:39:58 UTC
Created attachment 858162 [details]
0004-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch

0004-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
Comment 4 Marcus Meissner 2022-04-20 11:13:59 UTC
CRD: 2022-05-24
Comment 5 Michael Chang 2022-04-25 09:29:14 UTC
This CVE is only applicable to grub-2.04 and newer where there's verifier framework support. That means SLE versions less than SLE-15-SP1 is not required to fix the CVE as they are all staying on grub-2.02.

The SLE needs this CVE fix will be:

SLE-15-SP2 (2.04)
SLE-15-SP3 (2.04)
SLE-15-SP4 (2.06)
Comment 6 Marcus Meissner 2022-05-16 09:13:55 UTC
New CRD was set to allow shim code to be ready.

CRD: 2022-06-07 10:00PT
Comment 10 Marcus Meissner 2022-06-07 18:14:17 UTC
public now
Comment 11 Swamp Workflow Management 2022-06-10 13:17:18 UTC
SUSE-SU-2022:2035-1: An update that solves 7 vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 1191184,1191185,1191186,1193282,1197948,1198460,1198493,1198495,1198496,1198581
CVE References: CVE-2021-3695,CVE-2021-3696,CVE-2021-3697,CVE-2022-28733,CVE-2022-28734,CVE-2022-28735,CVE-2022-28736
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    grub2-2.06-150400.11.5.2
SUSE Linux Enterprise Module for Server Applications 15-SP4 (src):    grub2-2.06-150400.11.5.2
SUSE Linux Enterprise Module for SUSE Manager Proxy 4.3 (src):    grub2-2.06-150400.11.5.2
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    grub2-2.06-150400.11.5.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Swamp Workflow Management 2022-06-13 19:16:43 UTC
SUSE-SU-2022:2064-1: An update that solves 7 vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 1191184,1191185,1191186,1193282,1197948,1198460,1198493,1198495,1198496,1198581
CVE References: CVE-2021-3695,CVE-2021-3696,CVE-2021-3697,CVE-2022-28733,CVE-2022-28734,CVE-2022-28735,CVE-2022-28736
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    grub2-2.04-150300.22.20.2
SUSE Linux Enterprise Module for Server Applications 15-SP3 (src):    grub2-2.04-150300.22.20.2
SUSE Linux Enterprise Module for SUSE Manager Proxy 4.2 (src):    grub2-2.04-150300.22.20.2
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    grub2-2.04-150300.22.20.2
SUSE Linux Enterprise Micro 5.2 (src):    grub2-2.04-150300.22.20.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 13 Swamp Workflow Management 2022-06-14 13:16:36 UTC
SUSE-SU-2022:2074-1: An update that solves 7 vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 1191184,1191185,1191186,1193282,1197948,1198460,1198493,1198495,1198496,1198581
CVE References: CVE-2021-3695,CVE-2021-3696,CVE-2021-3697,CVE-2022-28733,CVE-2022-28734,CVE-2022-28735,CVE-2022-28736
JIRA References: 
Sources used:
SUSE Manager Server 4.1 (src):    grub2-2.04-150200.9.63.2
SUSE Manager Retail Branch Server 4.1 (src):    grub2-2.04-150200.9.63.2
SUSE Manager Proxy 4.1 (src):    grub2-2.04-150200.9.63.2
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    grub2-2.04-150200.9.63.2
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    grub2-2.04-150200.9.63.2
SUSE Linux Enterprise Server 15-SP2-BCL (src):    grub2-2.04-150200.9.63.2
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    grub2-2.04-150200.9.63.2
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    grub2-2.04-150200.9.63.2
SUSE Enterprise Storage 7 (src):    grub2-2.04-150200.9.63.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 14 Swamp Workflow Management 2022-06-14 13:19:39 UTC
SUSE-SU-2022:2073-1: An update that solves 7 vulnerabilities and has 14 fixes is now available.

Category: security (important)
Bug References: 1071559,1159205,1179981,1189769,1189874,1191184,1191185,1191186,1191504,1191974,1192522,1192622,1193282,1193532,1195204,1197948,1198460,1198493,1198495,1198496,1198581
CVE References: CVE-2021-3695,CVE-2021-3696,CVE-2021-3697,CVE-2022-28733,CVE-2022-28734,CVE-2022-28735,CVE-2022-28736
JIRA References: 
Sources used:
SUSE Linux Enterprise Micro 5.1 (src):    grub2-2.04-150300.3.5.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 15 Benjamin Brunner 2022-07-28 12:28:30 UTC
Bulk-re-assigning to the new bootloader-maintainers@suse.de group.