Bug 1878773

Summary:	System doesn't boot and prints "Verification failed: 0x1A Security Violation"
Product:	Red Hat Enterprise Linux 8	Reporter:	Renaud Métrich <rmetrich>
Component:	shim	Assignee:	Bootloader engineering team <bootloader-eng-team>
Status:	CLOSED NOTABUG	QA Contact:	Release Test Team <release-test-team>
Severity:	high	Docs Contact:
Priority:	medium
Version:	8.2	CC:	fmartine, yanghliu
Target Milestone:	rc
Target Release:	8.0
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-09-15 13:50:35 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Renaud Métrich 2020-09-14 13:41:32 UTC

Description of problem:

Reproduced on VMWare + QEMU+OVMF with Secure Boot enabled.
When shim-64 is latest (shim-x64-15-15.el8_2.x86_64) but grub2-efi-x64 isn't (grub2-efi-x64-2.02-82.el8_2.1.x86_64), the system fails to boot when secure boot is enabled.

From my understanding latest shim is supposed to handle older unpatched grub2 but apparently something is wrong here.


Version-Release number of selected component (if applicable):

shim-x64-15-15.el8_2.x86_64


How reproducible:

Always

Steps to Reproduce:
1. Install UEFI+SecureBoot RHEL8.2
2. Update all
3. Downgrade grub2 to 2.02-82.el8_2.1.x86_64

Actual results:

Verification failed: 0x1A Security Violation

Expected results:

Boot.

Comment 1 Javier Martinez Canillas 2020-09-15 13:50:35 UTC

This is expected behavior, the CVE-2020-10713 vulnerability response [0] says:

"Red Hat customers using Secure Boot need to update kernel, fwupdate, fwupd,
shim and dbxtool packages containing newly validated keys and certificates.".

Since the goal is to not allow the grub2 builds that contain the vulnerability
to be executed anymore when Secure Boot is enabled.

[0]: https://access.redhat.com/security/vulnerabilities/grub2bootloader