From: ludo@gnu.org (Ludovic Courtès)
To: Leo Famulari <leo@famulari.name>
Cc: guix-devel@gnu.org
Subject: Re: [PATCH 0/1] grub security update (CVE-2015-8370)
Date: Sun, 20 Dec 2015 23:19:44 +0100 [thread overview]
Message-ID: <87r3igsqyn.fsf@gnu.org> (raw)
In-Reply-To: <cover.1450587367.git.leo@famulari.name> (Leo Famulari's message of "Sat, 19 Dec 2015 23:56:35 -0500")
Leo Famulari <leo@famulari.name> skribis:
> This patch for Grub2 fixes CVE-2015-8370 [0][1]. The source of the patch
> is [0].
>
> One thing to note is that there doesn't seem to be any response from
> upstream, yet. However, at least some distros are applying the patch
> [2][3].
>
> AFAIK, GuixSD doesn't support authenticated Grub yet, so this
> vulnerability doesn't manifest itself.
Right, but still worth fixing.
And perhaps someone will get the idea of adding authentication in our
GRUB support code? :-)
> I tested this patch on bare-metal i686, like this:
Thanks for testing and explaining how you tested it.
Leo Famulari <leo@famulari.name> skribis:
> * gnu/packages/patches/grub-CVE-2015-8370.patch: New file.
> * gnu/packages/grub.scm: Apply patch.
> ---
> gnu/packages/grub.scm | 4 ++-
> gnu/packages/patches/grub-CVE-2015-8370.patch | 45 +++++++++++++++++++++++++++
> 2 files changed, 48 insertions(+), 1 deletion(-)
Please make sure to add the patch to gnu-system.am.
OK to push with this change.
Thank you!
Ludo’.
next prev parent reply other threads:[~2015-12-20 22:19 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-12-20 4:56 [PATCH 0/1] grub security update (CVE-2015-8370) Leo Famulari
2015-12-20 4:56 ` [PATCH 1/1] gnu: grub: Add fix for CVE-2015-8730 Leo Famulari
2015-12-20 22:19 ` Ludovic Courtès [this message]
2015-12-21 3:50 ` [PATCH 0/1] grub security update (CVE-2015-8370) Leo Famulari
2015-12-21 10:39 ` Ludovic Courtès
2015-12-21 17:39 ` Leo Famulari
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87r3igsqyn.fsf@gnu.org \
--to=ludo@gnu.org \
--cc=guix-devel@gnu.org \
--cc=leo@famulari.name \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.