Security update for keyboard input vulnerability.

- Fix security issue when reading username and password
  Related: CVE-2015-8370
- Do a better job of handling GRUB2_PASSWORD
  Related: rhbz#1284370

Signed-off-by: Peter Jones <pjones@redhat.com>

.gitignore

@@ -4,3 +4,5 @@ clog
 /unifont-5.1.20080820.pcf.gz
 /theme.tar.bz2
 kojilogs
+/grub-*/
+.build*.log

0075-Fix-security-issue-when-reading-username-and-passwor.patch

@@ -0,0 +1,47 @@
+From b059b6f9c7d236e83829689a1615f180f230baaa Mon Sep 17 00:00:00 2001
+From: Hector Marco-Gisbert <hecmargi@upv.es>
+Date: Fri, 13 Nov 2015 16:21:09 +0100
+Subject: [PATCH 75/76] Fix security issue when reading username and password
+
+  This patch fixes two integer underflows at:
+    * grub-core/lib/crypto.c
+    * grub-core/normal/auth.c
+
+Resolves: CVE-2015-8370
+
+Signed-off-by: Hector Marco-Gisbert <hecmargi@upv.es>
+Signed-off-by: Ismael Ripoll-Ripoll <iripoll@disca.upv.es>
+---
+ grub-core/lib/crypto.c  | 2 +-
+ grub-core/normal/auth.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/lib/crypto.c b/grub-core/lib/crypto.c
+index 010e550..524a3d8 100644
+--- a/grub-core/lib/crypto.c
++++ b/grub-core/lib/crypto.c
+@@ -468,7 +468,7 @@ grub_password_get (char buf[], unsigned buf_size)
+ 	  break;
+ 	}
+ 
+-      if (key == '\b')
++      if (key == '\b' && cur_len)
+ 	{
+ 	  cur_len--;
+ 	  continue;
+diff --git a/grub-core/normal/auth.c b/grub-core/normal/auth.c
+index c6bd96e..5782ec5 100644
+--- a/grub-core/normal/auth.c
++++ b/grub-core/normal/auth.c
+@@ -172,7 +172,7 @@ grub_username_get (char buf[], unsigned buf_size)
+ 	  break;
+ 	}
+ 
+-      if (key == '\b')
++      if (key == '\b' && cur_len)
+ 	{
+ 	  cur_len--;
+ 	  grub_printf ("\b");
+-- 
+2.5.0
+

0076-01_users-Handle-GRUB_PASSWORD-better.patch

@@ -0,0 +1,44 @@
+From e5e933f4fd449301fc1856db31ef1167b4867cd1 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Fri, 4 Dec 2015 09:28:38 -0500
+Subject: [PATCH 76/76] 01_users: Handle GRUB_PASSWORD better.
+
+Only handle GRUB2_PASSWORD not GRUB_PASSWORD.
+
+Related: rhbz#1284370
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ util/grub-setpassword.8 | 2 +-
+ util/grub.d/01_users.in | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/util/grub-setpassword.8 b/util/grub-setpassword.8
+index 5973abe..49200a8 100644
+--- a/util/grub-setpassword.8
++++ b/util/grub-setpassword.8
+@@ -9,7 +9,7 @@
+ \fBgrub-setpassword\fR outputs the user.cfg file which contains the hashed GRUB bootloader password. This utility only supports configurations where there is a single root user.
+ 
+ The file has the format:
+-GRUB_2PASSWORD=<\fIhashed password\fR>.
++GRUB2_PASSWORD=<\fIhashed password\fR>.
+ 
+ .SH OPTIONS
+ .TP
+diff --git a/util/grub.d/01_users.in b/util/grub.d/01_users.in
+index facd409..db2f44b 100644
+--- a/util/grub.d/01_users.in
++++ b/util/grub.d/01_users.in
+@@ -2,7 +2,7 @@
+ cat << EOF
+ if [ -f \${prefix}/user.cfg ]; then
+   source \${prefix}/user.cfg
+-  if [ -n \${GRUB2_PASSWORD} ]; then
++  if [ -n "\${GRUB2_PASSWORD}" ]; then
+     set superusers="root"
+     export superusers
+     password_pbkdf2 root \${GRUB2_PASSWORD}
+-- 
+2.5.0
+

grub2.spec

@@ -45,7 +45,7 @@
 Name:           grub2
 Epoch:          1
 Version:        2.02
-Release:        0.24%{?dist}
+Release:        0.25%{?dist}
 Summary:        Bootloader with support for Linux, Multiboot and more
 
 Group:          System Environment/Base
@@ -138,6 +138,8 @@ Patch0071: 0071-Make-exit-take-a-return-code.patch
 Patch0072: 0072-Add-some-__unused__-where-gcc-5.x-is-more-picky-abou.patch
 Patch0073: 0073-Fix-race-in-EFI-validation.patch
 Patch0074: 0074-Mark-po-exclude.pot-as-binary-so-git-won-t-try-to-di.patch
+Patch0075: 0075-Fix-security-issue-when-reading-username-and-passwor.patch
+Patch0076: 0076-01_users-Handle-GRUB_PASSWORD-better.patch
 
 
 
@@ -467,6 +469,34 @@ cp -a ${RPM_BUILD_ROOT}/usr/sbin %{finddebugroot}/usr/sbin
 %clean    
 rm -rf $RPM_BUILD_ROOT
 
+%pre tools
+if [ -f /boot/grub2/user.cfg ]; then
+    if grep -q '^GRUB_PASSWORD=' /boot/grub2/user.cfg ; then
+	sed -i 's/^GRUB_PASSWORD=/GRUB2_PASSWORD=/' /boot/grub2/user.cfg
+    fi
+elif [ -f /boot/efi/EFI/%{efidir}/user.cfg ]; then
+    if grep -q '^GRUB_PASSWORD=' /boot/efi/EFI/%{efidir}/user.cfg ; then
+	sed -i 's/^GRUB_PASSWORD=/GRUB2_PASSWORD=/' \
+	    /boot/efi/EFI/%{efidir}/user.cfg
+    fi
+elif [ -f /etc/grub.d/01_users ] && \
+	grep -q '^password_pbkdf2 root' /etc/grub.d/01_users ; then
+    if [ -f /boot/efi/EFI/%{efidir}/grub.cfg ]; then
+	# on EFI we don't get permissions on the file, but
+	# the directory is protected.
+	grep '^password_pbkdf2 root' /etc/grub.d/01_users | \
+		sed 's/^password_pbkdf2 root \(.*\)$/GRUB2_PASSWORD=\1/' \
+	    > /boot/efi/EFI/%{efidir}/user.cfg
+    fi
+    if [ -f /boot/grub2/grub.cfg ]; then
+	install -m 0600 /dev/null /boot/grub2/user.cfg
+	chmod 0600 /boot/grub2/user.cfg
+	grep '^password_pbkdf2 root' /etc/grub.d/01_users | \
+		sed 's/^password_pbkdf2 root \(.*\)$/GRUB2_PASSWORD=\1/' \
+	    > /boot/grub2/user.cfg
+    fi
+fi
+
 %post tools
 if [ "$1" = 1 ]; then
 	/sbin/install-info --info-dir=%{_infodir} %{_infodir}/%{name}.info.gz || :
@@ -596,6 +626,12 @@ fi
 %{_datarootdir}/grub/themes/starfield
 
 %changelog
+* Thu Dec 10 2015 Peter Jones <pjones@redhat.com> - 2.02-0.25
+- Fix security issue when reading username and password
+  Related: CVE-2015-8370
+- Do a better job of handling GRUB2_PASSWORD
+  Related: rhbz#1284370
+
 * Fri Nov 20 2015 Peter Jones <pjones@redhat.com> - 2.02-0.24
 - Rebuild without multiboot* modules in the EFI image.
   Related: rhbz#1264103