Bug 1862111
Summary: | update boot images to address CVE-2020-10713 | |||
---|---|---|---|---|
Product: | OpenShift Container Platform | Reporter: | Micah Abbott <miabbott> | |
Component: | RHCOS | Assignee: | Micah Abbott <miabbott> | |
Status: | CLOSED ERRATA | QA Contact: | Michael Nguyen <mnguyen> | |
Severity: | medium | Docs Contact: | ||
Priority: | high | |||
Version: | 4.6 | CC: | bbreard, dornelas, imcleod, jligon, nstielau, smilner | |
Target Milestone: | --- | |||
Target Release: | 4.6.0 | |||
Hardware: | Unspecified | |||
OS: | Unspecified | |||
Whiteboard: | ||||
Fixed In Version: | Doc Type: | If docs needed, set a value | ||
Doc Text: | Story Points: | --- | ||
Clone Of: | ||||
: | 1862112 (view as bug list) | Environment: | ||
Last Closed: | 2020-10-27 16:21:22 UTC | Type: | Bug | |
Regression: | --- | Mount Type: | --- | |
Documentation: | --- | CRM: | ||
Verified Versions: | Category: | --- | ||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
Cloudforms Team: | --- | Target Upstream Version: | ||
Embargoed: | ||||
Bug Depends On: | ||||
Bug Blocks: | 1186913, 1862112, 1862113 |
Description
Micah Abbott
2020-07-30 13:34:25 UTC
This is currently being worked on and work will continue next sprint. Verified on 4.6.0-0.nightly-2020-08-06-093209. $ oc get clusterversion NAME VERSION AVAILABLE PROGRESSING SINCE STATUS version 4.6.0-0.nightly-2020-08-06-093209 True False 12m Cluster version is 4.6.0-0.nightly-2020-08-06-093209 == log into the bootstrap node and check shim package == [core@ip-10-0-18-90 ~]$ rpm -qa | grep shim shim-x64-15-15.el8_2.x86_64 [core@ip-10-0-18-90 ~]$ rpm-ostree status State: idle Deployments: ● ostree://eada9e31e3e23e864b7c06bafa7b7756c0eceb38c1aa1e76e6bcf347d3663533 Version: 46.82.202008030340-0 (2020-08-03T03:44:50Z) [core@ip-10-0-18-90 ~]$ rpm -ql shim-x64 /boot/efi/EFI/BOOT/BOOTX64.EFI /boot/efi/EFI/BOOT/fbx64.efi /boot/efi/EFI/redhat/BOOTX64.CSV /boot/efi/EFI/redhat/mmx64.efi /boot/efi/EFI/redhat/shimx64-redhat.efi /boot/efi/EFI/redhat/shimx64.efi [core@ip-10-0-18-90 ~]$ rpm -qi shim-x64 Name : shim-x64 Version : 15 Release : 15.el8_2 Architecture: x86_64 Install Date: Mon 03 Aug 2020 03:42:30 AM UTC Group : Unspecified Size : 5252606 License : BSD Signature : RSA/SHA256, Fri 31 Jul 2020 11:10:11 PM UTC, Key ID 199e2f91fd431d51 Source RPM : shim-15-15.el8_2.src.rpm Build Date : Fri 31 Jul 2020 09:18:08 PM UTC Build Host : x86-vm-09.build.eng.bos.redhat.com Relocations : (not relocatable) Packager : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla> Vendor : Red Hat, Inc. URL : https://github.com/rhboot/shim/ Summary : First-stage UEFI bootloader Description : Initial UEFI bootloader that handles chaining to a trusted full bootloader under secure boot environments. This package contains the version signed by the UEFI signing service. [core@ip-10-0-18-90 ~]$ == log into master node and check shim package and bootstrapped shim package == $ oc get nodes NAME STATUS ROLES AGE VERSION ip-10-0-134-205.us-west-2.compute.internal Ready master 29m v0.0.0-master+$Format:%h$ ip-10-0-148-218.us-west-2.compute.internal Ready worker 17m v0.0.0-master+$Format:%h$ ip-10-0-175-60.us-west-2.compute.internal Ready master 29m v0.0.0-master+$Format:%h$ ip-10-0-188-122.us-west-2.compute.internal Ready worker 17m v0.0.0-master+$Format:%h$ ip-10-0-201-138.us-west-2.compute.internal Ready master 28m v0.0.0-master+$Format:%h$ ip-10-0-211-133.us-west-2.compute.internal Ready worker 17m v0.0.0-master+$Format:%h$ $ oc debug node/ip-10-0-134-205.us-west-2.compute.internal Starting pod/ip-10-0-134-205us-west-2computeinternal-debug ... To use host binaries, run `chroot /host` If you don't see a command prompt, try pressing enter. sh-4.2# chroot /host sh-4.4# rpm-ostree status State: idle Deployments: * pivot://quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:16a8dde4b893ff0b5b4aeb05474f2f5e2ce9cac45d5d3e98b40c4309e23215a7 CustomOrigin: Managed by machine-config-operator Version: 46.82.202008032211-0 (2020-08-03T22:15:23Z) ostree://eada9e31e3e23e864b7c06bafa7b7756c0eceb38c1aa1e76e6bcf347d3663533 Version: 46.82.202008030340-0 (2020-08-03T03:44:50Z) sh-4.4# rpm -q shim-x64 shim-x64-15-15.el8_2.x86_64 sh-4.4# rpm-ostree db list eada9e31e3e23e864b7c06bafa7b7756c0eceb38c1aa1e76e6bcf347d3663533 | grep shim shim-x64-15-15.el8_2.x86_64 sh-4.4# exit exit sh-4.2# exit exit Removing debug pod ... == log into the worker node and check the shim package and the bootstrapped shim package == $ oc get node NAME STATUS ROLES AGE VERSION ip-10-0-134-205.us-west-2.compute.internal Ready master 33m v0.0.0-master+$Format:%h$ ip-10-0-148-218.us-west-2.compute.internal Ready worker 21m v0.0.0-master+$Format:%h$ ip-10-0-175-60.us-west-2.compute.internal Ready master 33m v0.0.0-master+$Format:%h$ ip-10-0-188-122.us-west-2.compute.internal Ready worker 22m v0.0.0-master+$Format:%h$ ip-10-0-201-138.us-west-2.compute.internal Ready master 33m v0.0.0-master+$Format:%h$ ip-10-0-211-133.us-west-2.compute.internal Ready worker 22m v0.0.0-master+$Format:%h$ $ oc debug node/ip-10-0-148-218.us-west-2.compute.internal Starting pod/ip-10-0-148-218us-west-2computeinternal-debug ... To use host binaries, run `chroot /host` If you don't see a command prompt, try pressing enter. sh-4.2# chroot /host sh-4.4# rpm-ostree status State: idle Deployments: * pivot://quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:16a8dde4b893ff0b5b4aeb05474f2f5e2ce9cac45d5d3e98b40c4309e23215a7 CustomOrigin: Managed by machine-config-operator Version: 46.82.202008032211-0 (2020-08-03T22:15:23Z) ostree://eada9e31e3e23e864b7c06bafa7b7756c0eceb38c1aa1e76e6bcf347d3663533 Version: 46.82.202008030340-0 (2020-08-03T03:44:50Z) sh-4.4# rpm -q shim-x64 shim-x64-15-15.el8_2.x86_64 sh-4.4# rpm-ostree db list eada9e31e3e23e864b7c06bafa7b7756c0eceb38c1aa1e76e6bcf347d3663533 | grep shim shim-x64-15-15.el8_2.x86_64 sh-4.4# exit exit sh-4.2# exit exit Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (OpenShift Container Platform 4.6 GA Images), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:4196 |