Bug 1286966 (CVE-2015-8370)
| Summary: | CVE-2015-8370 grub2: buffer overflow when checking password entered during bootup | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Martin Prpič <mprpic> | ||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||
| Status: | CLOSED ERRATA | QA Contact: | |||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | unspecified | CC: | bootloader-eng-team, carnil, ggasparb, jaredz, jpazdziora, mbanas, mlewando, pjanda, pjones, pkotvan, pmatouse, rharwood, security-response-team | ||||
| Target Milestone: | --- | Keywords: | Security | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: |
A flaw was found in the way grub2 handled backspace characters entered in username and password prompts. An attacker with access to the system console could use this flaw to bypass grub2 password protection and gain administrative access to the system.
|
Story Points: | --- | ||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2015-12-15 11:07:38 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 1288493, 1288494, 1290417 | ||||||
| Bug Blocks: | 1286968 | ||||||
| Attachments: |
|
||||||
|
Description
Martin Prpič
2015-12-01 09:09:42 UTC
Created attachment 1100986 [details]
Upstream fix
Here's the fix.
Created grub2 tracking bugs for this issue: Affects: fedora-all [bug 1290417] This flaw has been presented at the CCN-CERT conference by the UPV security team: https://twitter.com/lostinsecurity/status/674925944524640257 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2015:2623 https://rhn.redhat.com/errata/RHSA-2015-2623.html Detailed write-up from the original reporters. External References: http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html Upstream commit: http://git.savannah.gnu.org/cgit/grub.git/commit/?id=451d80e52d851432e109771bb8febafca7a5f1f2 Hello, while doing review of the Vulnerability Assessment report of RHEL 8.6 for the purpose of Common Criteria certification, we came across this CVE-2015-8370. The CVE page https://access.redhat.com/security/cve/cve-2015-8370 does not list RHEL 8 at all but RHEL 8 ships grub2 2.02 (specifically in RHEL 8.6 it is 2.02-123.el8). I assume we still carry the patch in RHEL 8 so the vulnerability is mitigated there but shouldn't the CVE page mention RHEL 8 as well? Thank you, Jan In reply to comment #12: > I assume we still carry the patch in RHEL 8 so the vulnerability is > mitigated there but shouldn't the CVE page mention RHEL 8 as well? I've added an entry for rhel-8, but note that this CVE is from 2015, that is before rhel-8 even existed. we can't anticipate future releases; the general rule is to not release major versions with known CVEs, any future major version should include the fix regardless of being mentioned on CVE pages or not. |