diff --git a/.gitignore b/.gitignore index 618dc68..0342d81 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,3 @@ SOURCES/grub-2.02~beta2.tar.xz SOURCES/theme.tar.bz2 SOURCES/unifont-5.1.20080820.pcf.gz -SOURCES/centos.cer diff --git a/.grub2.metadata b/.grub2.metadata index a5c2c6a..261f908 100644 --- a/.grub2.metadata +++ b/.grub2.metadata @@ -1,4 +1,3 @@ 1bf580f1e8bce4909a7ac7ca485cee02b00ed383 SOURCES/grub-2.02~beta2.tar.xz cf0b7763c528902da7e8b05cfa248f20c8825ce5 SOURCES/theme.tar.bz2 87f8600ba24e521b5d20bdf6c4b71af8ae861e3a SOURCES/unifont-5.1.20080820.pcf.gz -6e9105eb51e55a46761838f289a917611cad8091 SOURCES/centos.cer diff --git a/SOURCES/0186-Fix-security-issue-when-reading-username-and-passwor.patch b/SOURCES/0186-Fix-security-issue-when-reading-username-and-passwor.patch new file mode 100644 index 0000000..6419faf --- /dev/null +++ b/SOURCES/0186-Fix-security-issue-when-reading-username-and-passwor.patch @@ -0,0 +1,47 @@ +From 3afaf579fb89ee4e1f6fc53f950e8ec574a9489a Mon Sep 17 00:00:00 2001 +From: Hector Marco-Gisbert +Date: Fri, 13 Nov 2015 16:21:09 +0100 +Subject: [PATCH 186/187] Fix security issue when reading username and password + + This patch fixes two integer underflows at: + * grub-core/lib/crypto.c + * grub-core/normal/auth.c + +Resolves: CVE-2015-8370 + +Signed-off-by: Hector Marco-Gisbert +Signed-off-by: Ismael Ripoll-Ripoll +--- + grub-core/lib/crypto.c | 2 +- + grub-core/normal/auth.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/lib/crypto.c b/grub-core/lib/crypto.c +index 8e8426c..a23519c 100644 +--- a/grub-core/lib/crypto.c ++++ b/grub-core/lib/crypto.c +@@ -456,7 +456,7 @@ grub_password_get (char buf[], unsigned buf_size) + break; + } + +- if (key == '\b') ++ if (key == '\b' && cur_len) + { + cur_len--; + continue; +diff --git a/grub-core/normal/auth.c b/grub-core/normal/auth.c +index c6bd96e..5782ec5 100644 +--- a/grub-core/normal/auth.c ++++ b/grub-core/normal/auth.c +@@ -172,7 +172,7 @@ grub_username_get (char buf[], unsigned buf_size) + break; + } + +- if (key == '\b') ++ if (key == '\b' && cur_len) + { + cur_len--; + grub_printf ("\b"); +-- +2.5.0 + diff --git a/SOURCES/0187-01_users-Handle-GRUB_PASSWORD-better.patch b/SOURCES/0187-01_users-Handle-GRUB_PASSWORD-better.patch new file mode 100644 index 0000000..18bc327 --- /dev/null +++ b/SOURCES/0187-01_users-Handle-GRUB_PASSWORD-better.patch @@ -0,0 +1,45 @@ +From dcc927227824dbcb9a7e1f809aedf2b1e08078b3 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Fri, 4 Dec 2015 09:28:38 -0500 +Subject: [PATCH 187/187] 01_users: Handle GRUB_PASSWORD better. + +Only handle GRUB_PASSWORD not GRUB2_PASSWORD (as that's more likely to +be acceptable upstream). + +Related: rhbz#1284370 + +Signed-off-by: Peter Jones +--- + util/grub-setpassword.8 | 2 +- + util/grub.d/01_users.in | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/util/grub-setpassword.8 b/util/grub-setpassword.8 +index 5973abe..49200a8 100644 +--- a/util/grub-setpassword.8 ++++ b/util/grub-setpassword.8 +@@ -9,7 +9,7 @@ + \fBgrub-setpassword\fR outputs the user.cfg file which contains the hashed GRUB bootloader password. This utility only supports configurations where there is a single root user. + + The file has the format: +-GRUB_2PASSWORD=<\fIhashed password\fR>. ++GRUB2_PASSWORD=<\fIhashed password\fR>. + + .SH OPTIONS + .TP +diff --git a/util/grub.d/01_users.in b/util/grub.d/01_users.in +index facd409..db2f44b 100644 +--- a/util/grub.d/01_users.in ++++ b/util/grub.d/01_users.in +@@ -2,7 +2,7 @@ + cat << EOF + if [ -f \${prefix}/user.cfg ]; then + source \${prefix}/user.cfg +- if [ -n \${GRUB2_PASSWORD} ]; then ++ if [ -n "\${GRUB2_PASSWORD}" ]; then + set superusers="root" + export superusers + password_pbkdf2 root \${GRUB2_PASSWORD} +-- +2.5.0 + diff --git a/SPECS/grub2.spec b/SPECS/grub2.spec index 349a48d..307739e 100644 --- a/SPECS/grub2.spec +++ b/SPECS/grub2.spec @@ -33,9 +33,6 @@ %if 0%{?fedora} %global efidir fedora %endif -%if 0%{?centos} -%global efidir centos -%endif %endif @@ -45,7 +42,7 @@ Name: grub2 Epoch: 1 Version: 2.02 -Release: 0.29%{?dist} +Release: 0.33%{?dist} Summary: Bootloader with support for Linux, Multiboot and more Group: System Environment/Base @@ -53,9 +50,9 @@ License: GPLv3+ URL: http://www.gnu.org/software/grub/ Obsoletes: grub < 1:0.98 Source0: ftp://alpha.gnu.org/gnu/grub/grub-%{tarversion}.tar.xz -#Source0: ftp://ftp.gnu.org/gnu/grub/grub-%{tarversion}.tar.xz -Source1: centos.cer -#(source removed) +#Source0: ftp://ftp.gnu.org/gnu/grub/grub-%%{tarversion}.tar.xz +Source1: securebootca.cer +Source2: secureboot.cer Source4: http://unifoundry.com/unifont-5.1.20080820.pcf.gz Source5: theme.tar.bz2 Source6: gitignore @@ -246,6 +243,8 @@ Patch0182: 0182-tcp-add-window-scaling-support.patch Patch0183: 0183-efinet-retransmit-if-our-device-is-busy.patch Patch0184: 0184-Be-more-aggro-about-actually-using-the-configured-ne.patch Patch0185: 0185-efinet-add-filter-for-the-first-exclusive-reopen-of-.patch +Patch0186: 0186-Fix-security-issue-when-reading-username-and-passwor.patch +Patch0187: 0187-01_users-Handle-GRUB_PASSWORD-better.patch @@ -397,8 +396,8 @@ GRUB_MODULES="${GRUB_MODULES} linuxefi" mv %{grubefiname}.orig %{grubefiname} mv %{grubeficdname}.orig %{grubeficdname} %else -%pesign -s -i %{grubefiname}.orig -o %{grubefiname} -a %{SOURCE1} -c %{SOURCE1} -n redhatsecureboot301 -%pesign -s -i %{grubeficdname}.orig -o %{grubeficdname} -a %{SOURCE1} -c %{SOURCE1} -n redhatsecureboot301 +%pesign -s -i %{grubefiname}.orig -o %{grubefiname} -a %{SOURCE1} -c %{SOURCE2} -n redhatsecureboot301 +%pesign -s -i %{grubeficdname}.orig -o %{grubeficdname} -a %{SOURCE1} -c %{SOURCE2} -n redhatsecureboot301 %endif cd .. %endif @@ -549,23 +548,30 @@ ln -s /boot/efi/EFI/%{efidir}/grubenv boot/grub2/grubenv rm -rf $RPM_BUILD_ROOT %pre tools -if [ $1 -gt 1 ]; then - if [ -f /etc/grub.d/01_users ] && \ - grep -c -q '^password_pbkdf2 root' /etc/grub.d/01_users ; then - if [ -f /boot/efi/EFI/%{efidir}/grub.cfg ]; then - # on EFI we don't get permissions on the file, but - # the directory is protected. - grep '^password_pbkdf2 root' /etc/grub.d/01_users | \ - sed 's/^password_pbkdf2 root \(.*\)$/GRUB_PASSWORD=\1/' \ - > /boot/efi/EFI/%{efidir}/user.cfg - fi - if [ -f /boot/grub2/grub.cfg ]; then - install -m 0600 /dev/null /boot/grub2/user.cfg - chmod 0600 /boot/grub2/user.cfg - grep '^password_pbkdf2 root' /etc/grub.d/01_users | \ - sed 's/^password_pbkdf2 root \(.*\)$/GRUB_PASSWORD=\1/' \ - > /boot/grub2/user.cfg - fi +if [ -f /boot/grub2/user.cfg ]; then + if grep -q '^GRUB_PASSWORD=' /boot/grub2/user.cfg ; then + sed -i 's/^GRUB_PASSWORD=/GRUB2_PASSWORD=/' /boot/grub2/user.cfg + fi +elif [ -f /boot/efi/EFI/%{efidir}/user.cfg ]; then + if grep -q '^GRUB_PASSWORD=' /boot/efi/EFI/%{efidir}/user.cfg ; then + sed -i 's/^GRUB_PASSWORD=/GRUB2_PASSWORD=/' \ + /boot/efi/EFI/%{efidir}/user.cfg + fi +elif [ -f /etc/grub.d/01_users ] && \ + grep -q '^password_pbkdf2 root' /etc/grub.d/01_users ; then + if [ -f /boot/efi/EFI/%{efidir}/grub.cfg ]; then + # on EFI we don't get permissions on the file, but + # the directory is protected. + grep '^password_pbkdf2 root' /etc/grub.d/01_users | \ + sed 's/^password_pbkdf2 root \(.*\)$/GRUB2_PASSWORD=\1/' \ + > /boot/efi/EFI/%{efidir}/user.cfg + fi + if [ -f /boot/grub2/grub.cfg ]; then + install -m 0600 /dev/null /boot/grub2/user.cfg + chmod 0600 /boot/grub2/user.cfg + grep '^password_pbkdf2 root' /etc/grub.d/01_users | \ + sed 's/^password_pbkdf2 root \(.*\)$/GRUB2_PASSWORD=\1/' \ + > /boot/grub2/user.cfg fi fi @@ -695,9 +701,23 @@ fi %exclude %{_datarootdir}/grub/themes/starfield %changelog -* Thu Nov 19 2015 CentOS Sources - 2.02-0.29.el7.centos -- Roll in CentOS Secureboot keys -- Move the edidir to be CentOS, so people can co-install fedora, rhel and centos +* Thu Dec 10 2015 Peter Jones - 2.02-0.33 +- Don't remove 01_users, it's the wrong thing to do. + Related:rhbz1290089 + +* Wed Dec 09 2015 Peter Jones - 2.02-0.32 +- Rebuild for .z so the release number is different. + Related: rhbz#1290089 + +* Wed Dec 09 2015 Peter Jones - 2.02-0.31 +- More work on handling of GRUB2_PASSWORD + Resolves: rhbz#1290089 + +* Tue Dec 08 2015 Peter Jones - 2.02-0.30 +- Fix security issue when reading username and password + Resolves: CVE-2015-8370 +- Do a better job of handling GRUB_PASSWORD + Resolves: rhbz#1290089 * Fri Oct 09 2015 Peter Jones - 2.02-0.29 - Fix DHCP6 timeouts due to failed network stack once more.