Bug 1243998
| Summary: | CVE-2015-7837 kernel: securelevel disabled after kexec [rhel-7.2] | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Linn Crosetto <linn> | ||||
| Component: | kernel | Assignee: | Dave Young <ruyang> | ||||
| kernel sub component: | Other | QA Contact: | Qiao Zhao <qzhao> | ||||
| Status: | CLOSED ERRATA | Docs Contact: | |||||
| Severity: | high | ||||||
| Priority: | unspecified | CC: | linn, pmatouse, qzhao, ruyang, security-response-team, shdeng, vgoyal, wmealing | ||||
| Version: | 7.2 | Keywords: | Security, SecurityTracking | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | x86_64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | kernel-3.10.0-305.el7 | Doc Type: | Release Note | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2015-11-19 22:57:21 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 1272472 | ||||||
| Attachments: |
|
||||||
The patch needs a small change if it is to be x86-only, which is what was tested:
diff --git a/init/main.c b/init/main.c
index eee9db7..65395f9 100644
--- a/init/main.c
+++ b/init/main.c
@@ -636,11 +636,11 @@ asmlinkage __visible void __init start_kernel(void)
anon_vma_init();
acpi_early_init();
#ifdef CONFIG_X86
- if (efi_enabled(EFI_RUNTIME_SERVICES))
+ if (efi_enabled(EFI_RUNTIME_SERVICES)) {
efi_enter_virtual_mode();
-#endif
- if (efi_enabled(EFI_RUNTIME_SERVICES))
efi_secure_boot_init();
+ }
+#endif
Hi, Linn
Could you try if below oneline change fixes the problem?
Thanks
Dave
diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index 9642b9b..0539ec7 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -178,6 +178,7 @@ setup_efi_state(struct boot_params *params, unsigned long params_load_addr,
if (efi_enabled(EFI_OLD_MEMMAP))
return 0;
+ params->secure_boot = boot_params.secure_boot;
ei->efi_loader_signature = current_ei->efi_loader_signature;
ei->efi_systab = current_ei->efi_systab;
ei->efi_systab_hi = current_ei->efi_systab_hi;
Hi Dave, This change works. It should be sufficient, since I suppose it is unlikely we would encounter a signed copy of a bootloader that does not use the efi stub. Thanks. Linn, Thanks for testing, I will post to RHEL list soon. *** Bug 1273216 has been marked as a duplicate of this bug. *** *** Bug 1273217 has been marked as a duplicate of this bug. *** Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-2152.html |
Created attachment 1052836 [details] patch Description of problem: When RHEL 7.1 is booted with UEFI Secure Boot enabled, securelevel is set. If kexec is then used to load the same kernel, after reboot securelevel is disabled. In this state, the system is missing the protections provided by securelevel, for example kexec may be used to load an unsigned kernel via the legacy system call kexec_load. In the securelevel patchset, the state of UEFI Secure Boot is queried in the EFI stub, and sets a boot_params flag to indicate the state of UEFI Secure Boot. This flag is then used in setup_arch() to determine the correct state of securelevel. If the kernel is not booted via the EFI stub, securelevel is not set even if UEFI Secure Boot is enabled. I have attached a patch to upstream 4.1 (on top of the securelevel series) to query the state of UEFI Secure Boot from an init routine in start_kernel(), which covers both the EFI stub and non EFI stub cases to set securelevel correctly. An alternative might be to make kexec_tools aware of the secure_boot flag in boot_params and pass it to the new kernel, but that would still assume the first kernel was booted through the EFI stub and had it set. Version-Release number of selected component (if applicable): RHEL 7.1 How reproducible: Always Steps to Reproduce: 1. Boot RHEL 7.1 on a system with UEFI Secure Boot enabled 2. kexec -s -l /boot/vmlinuz-3.10.0-229.7.2.el7.x86_64 --initrd=/boot/initramfs-3.10.0-229.7.2.el7.x86_64.img --reuse-cmdline 3. reboot 4. cat /sys/kernel/security/securelevel 5. kexec -l /boot/vmlinuz-3.10.0-229.7.2.el7.x86_64 --initrd=/boot/initramfs-3.10.0-229.7.2.el7.x86_64.img --reuse-cmdline 6. reboot Actual results: securelevel is 0 after kexec with UEFI Secure Boot enabled Expected results: securelevel is 1 after kexec with UEFI Secure Boot enabled Additional info: