From: Leo Famulari <leo@famulari.name>
To: guix-devel@gnu.org
Subject: [PATCH 0/1] grub security update (CVE-2015-8370)
Date: Sat, 19 Dec 2015 23:56:35 -0500 [thread overview]
Message-ID: <cover.1450587367.git.leo@famulari.name> (raw)
This patch for Grub2 fixes CVE-2015-8370 [0][1]. The source of the patch
is [0].
One thing to note is that there doesn't seem to be any response from
upstream, yet. However, at least some distros are applying the patch
[2][3].
AFAIK, GuixSD doesn't support authenticated Grub yet, so this
vulnerability doesn't manifest itself. Because of this, I did not test
if the patch fixes the bug. I did test that Grub works as expected with
the patch applied.
If I'm wrong, and it's possible to set up authenticated Grub on GuixSD,
I can test that, too.
I tested this patch on bare-metal i686, like this:
0) Installed GuixSD on i686 laptop.
1) Cloned Guix source tree and built Guix.
2) Applied this patch, and built Grub as a sanity check.
`./pre-inst-env guix build grub`
3) Reconfigured the system against the source tree.
`./pre-inst-env guix system reconfigure config.scm`
4) Successfully rebooted several times into different generations of the
system.
[0]
http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html
[1]
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8370
[2] Select "Fedora 23" from the "RELEASE" menu:
https://apps.fedoraproject.org/packages/grub2/sources/spec/
[3] See "changelog":
https://packages.qa.debian.org/g/grub2.html
Leo Famulari (1):
gnu: grub: Add fix for CVE-2015-8730.
gnu/packages/grub.scm | 4 ++-
gnu/packages/patches/grub-CVE-2015-8370.patch | 45 +++++++++++++++++++++++++++
2 files changed, 48 insertions(+), 1 deletion(-)
create mode 100644 gnu/packages/patches/grub-CVE-2015-8370.patch
--
2.6.2
next reply other threads:[~2015-12-20 4:56 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-12-20 4:56 Leo Famulari [this message]
2015-12-20 4:56 ` [PATCH 1/1] gnu: grub: Add fix for CVE-2015-8730 Leo Famulari
2015-12-20 22:19 ` [PATCH 0/1] grub security update (CVE-2015-8370) Ludovic Courtès
2015-12-21 3:50 ` Leo Famulari
2015-12-21 10:39 ` Ludovic Courtès
2015-12-21 17:39 ` Leo Famulari
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cover.1450587367.git.leo@famulari.name \
--to=leo@famulari.name \
--cc=guix-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.