diff --git a/.gitignore b/.gitignore index af328b5..8336d4e 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,5 @@ clog /unifont-5.1.20080820.pcf.gz /theme.tar.bz2 kojilogs +/grub-*/ +.build*.log diff --git a/0075-Fix-security-issue-when-reading-username-and-passwor.patch b/0075-Fix-security-issue-when-reading-username-and-passwor.patch new file mode 100644 index 0000000..6d0b638 --- /dev/null +++ b/0075-Fix-security-issue-when-reading-username-and-passwor.patch @@ -0,0 +1,47 @@ +From b059b6f9c7d236e83829689a1615f180f230baaa Mon Sep 17 00:00:00 2001 +From: Hector Marco-Gisbert +Date: Fri, 13 Nov 2015 16:21:09 +0100 +Subject: [PATCH 75/76] Fix security issue when reading username and password + + This patch fixes two integer underflows at: + * grub-core/lib/crypto.c + * grub-core/normal/auth.c + +Resolves: CVE-2015-8370 + +Signed-off-by: Hector Marco-Gisbert +Signed-off-by: Ismael Ripoll-Ripoll +--- + grub-core/lib/crypto.c | 2 +- + grub-core/normal/auth.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/lib/crypto.c b/grub-core/lib/crypto.c +index 010e550..524a3d8 100644 +--- a/grub-core/lib/crypto.c ++++ b/grub-core/lib/crypto.c +@@ -468,7 +468,7 @@ grub_password_get (char buf[], unsigned buf_size) + break; + } + +- if (key == '\b') ++ if (key == '\b' && cur_len) + { + cur_len--; + continue; +diff --git a/grub-core/normal/auth.c b/grub-core/normal/auth.c +index c6bd96e..5782ec5 100644 +--- a/grub-core/normal/auth.c ++++ b/grub-core/normal/auth.c +@@ -172,7 +172,7 @@ grub_username_get (char buf[], unsigned buf_size) + break; + } + +- if (key == '\b') ++ if (key == '\b' && cur_len) + { + cur_len--; + grub_printf ("\b"); +-- +2.5.0 + diff --git a/0076-01_users-Handle-GRUB_PASSWORD-better.patch b/0076-01_users-Handle-GRUB_PASSWORD-better.patch new file mode 100644 index 0000000..4e0e047 --- /dev/null +++ b/0076-01_users-Handle-GRUB_PASSWORD-better.patch @@ -0,0 +1,44 @@ +From e5e933f4fd449301fc1856db31ef1167b4867cd1 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Fri, 4 Dec 2015 09:28:38 -0500 +Subject: [PATCH 76/76] 01_users: Handle GRUB_PASSWORD better. + +Only handle GRUB2_PASSWORD not GRUB_PASSWORD. + +Related: rhbz#1284370 + +Signed-off-by: Peter Jones +--- + util/grub-setpassword.8 | 2 +- + util/grub.d/01_users.in | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/util/grub-setpassword.8 b/util/grub-setpassword.8 +index 5973abe..49200a8 100644 +--- a/util/grub-setpassword.8 ++++ b/util/grub-setpassword.8 +@@ -9,7 +9,7 @@ + \fBgrub-setpassword\fR outputs the user.cfg file which contains the hashed GRUB bootloader password. This utility only supports configurations where there is a single root user. + + The file has the format: +-GRUB_2PASSWORD=<\fIhashed password\fR>. ++GRUB2_PASSWORD=<\fIhashed password\fR>. + + .SH OPTIONS + .TP +diff --git a/util/grub.d/01_users.in b/util/grub.d/01_users.in +index facd409..db2f44b 100644 +--- a/util/grub.d/01_users.in ++++ b/util/grub.d/01_users.in +@@ -2,7 +2,7 @@ + cat << EOF + if [ -f \${prefix}/user.cfg ]; then + source \${prefix}/user.cfg +- if [ -n \${GRUB2_PASSWORD} ]; then ++ if [ -n "\${GRUB2_PASSWORD}" ]; then + set superusers="root" + export superusers + password_pbkdf2 root \${GRUB2_PASSWORD} +-- +2.5.0 + diff --git a/grub2.spec b/grub2.spec index 8220398..1eaedec 100644 --- a/grub2.spec +++ b/grub2.spec @@ -45,7 +45,7 @@ Name: grub2 Epoch: 1 Version: 2.02 -Release: 0.24%{?dist} +Release: 0.25%{?dist} Summary: Bootloader with support for Linux, Multiboot and more Group: System Environment/Base @@ -138,6 +138,8 @@ Patch0071: 0071-Make-exit-take-a-return-code.patch Patch0072: 0072-Add-some-__unused__-where-gcc-5.x-is-more-picky-abou.patch Patch0073: 0073-Fix-race-in-EFI-validation.patch Patch0074: 0074-Mark-po-exclude.pot-as-binary-so-git-won-t-try-to-di.patch +Patch0075: 0075-Fix-security-issue-when-reading-username-and-passwor.patch +Patch0076: 0076-01_users-Handle-GRUB_PASSWORD-better.patch @@ -467,6 +469,34 @@ cp -a ${RPM_BUILD_ROOT}/usr/sbin %{finddebugroot}/usr/sbin %clean rm -rf $RPM_BUILD_ROOT +%pre tools +if [ -f /boot/grub2/user.cfg ]; then + if grep -q '^GRUB_PASSWORD=' /boot/grub2/user.cfg ; then + sed -i 's/^GRUB_PASSWORD=/GRUB2_PASSWORD=/' /boot/grub2/user.cfg + fi +elif [ -f /boot/efi/EFI/%{efidir}/user.cfg ]; then + if grep -q '^GRUB_PASSWORD=' /boot/efi/EFI/%{efidir}/user.cfg ; then + sed -i 's/^GRUB_PASSWORD=/GRUB2_PASSWORD=/' \ + /boot/efi/EFI/%{efidir}/user.cfg + fi +elif [ -f /etc/grub.d/01_users ] && \ + grep -q '^password_pbkdf2 root' /etc/grub.d/01_users ; then + if [ -f /boot/efi/EFI/%{efidir}/grub.cfg ]; then + # on EFI we don't get permissions on the file, but + # the directory is protected. + grep '^password_pbkdf2 root' /etc/grub.d/01_users | \ + sed 's/^password_pbkdf2 root \(.*\)$/GRUB2_PASSWORD=\1/' \ + > /boot/efi/EFI/%{efidir}/user.cfg + fi + if [ -f /boot/grub2/grub.cfg ]; then + install -m 0600 /dev/null /boot/grub2/user.cfg + chmod 0600 /boot/grub2/user.cfg + grep '^password_pbkdf2 root' /etc/grub.d/01_users | \ + sed 's/^password_pbkdf2 root \(.*\)$/GRUB2_PASSWORD=\1/' \ + > /boot/grub2/user.cfg + fi +fi + %post tools if [ "$1" = 1 ]; then /sbin/install-info --info-dir=%{_infodir} %{_infodir}/%{name}.info.gz || : @@ -596,6 +626,12 @@ fi %{_datarootdir}/grub/themes/starfield %changelog +* Thu Dec 10 2015 Peter Jones - 2.02-0.25 +- Fix security issue when reading username and password + Related: CVE-2015-8370 +- Do a better job of handling GRUB2_PASSWORD + Related: rhbz#1284370 + * Fri Nov 20 2015 Peter Jones - 2.02-0.24 - Rebuild without multiboot* modules in the EFI image. Related: rhbz#1264103