Bug 40282 – grub2: CVE-2015-8370 (3.2)

Bug 40282 - grub2: CVE-2015-8370 (3.2)


Summary:	grub2: CVE-2015-8370 (3.2)

Status:	CLOSED FIXED

Product:	UCS
Classification:	Unclassified
Component:	Security updates
Version:	UCS 3.2
Hardware:	Other Linux

Importance:	P4 normal (vote)
Target Milestone:	UCS 3.2-8-errata
Assigned To:	Janek Walkenhorst
QA Contact:	Philipp Hahn

URL:
Keywords:

Depends on:
Blocks:	41364
	Show dependency tree / graph

Reported:	2015-12-17 14:39 CET by Arvid Requate
Modified:	2016-06-01 16:12 CEST (History)
CC List:	1 user (show)

See Also:
What kind of report is it?:	---
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):	Security
Max CVSS v3 score:

Flags:	requate: Patch_Available+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Arvid Requate

2015-12-17 14:39:08 CET

+++ This bug was initially created as a clone of Bug #40281 +++

The following issues have been identified in grub2:

* buffer overflow when checking password entered during bootup (CVE-2015-8370)

Fixed in squeeze version 1.98+20100804-14+squeeze2.

Comment 1 Janek Walkenhorst

2016-05-26 18:52:53 CEST

r16548
 Upstream fix backported as
 grub2/3.2-0-0-ucs/2.00-18-errata3.2-8/CVE-2015-8370.patch

r69570
 Advisory:
 grub2.yaml

Comment 2 Janek Walkenhorst

2016-05-27 18:06:11 CEST

How to reproduce:

--- /etc/grub.d/00_header
+++ /etc/grub.d/00_header
@@ -315,3 +315,8 @@
 if [ "x${GRUB_BADRAM}" != "x" ] ; then
   echo "badram ${GRUB_BADRAM}"
 fi
+
+cat <<EOF
+set superusers="benutzer"
+password benutzer univention
+EOF

update-grub
shutdown -r now
On username and password prompt press Backspace at least 28 times, before trying to enter the username or password.

Comment 3 Janek Walkenhorst

2016-05-27 18:09:52 CEST

Tests (amd64 KVM, i386 KVM): OK

Comment 4 Philipp Hahn

2016-05-31 13:49:02 CEST

OK: amd64 @ kvm
OK: i386 @ kvm
 both did not crash bat did not accept correctly entered credentials - now works
OK: dpkg-query -W grub-common # 2.00-18.110.201605271548
OK: zless /usr/share/doc/grub-common/changelog.Debian.gz

OK: errata-announce -V --only grub2.yaml
FIXED: r69641 grub2.yaml

Comment 5 Janek Walkenhorst

2016-06-01 16:12:07 CEST

<http://errata.software-univention.de/ucs/3.2/428.html>