Bug 2089529 (CVE-2022-1665)

Summary: CVE-2022-1665 Kernel for IBM Power: Signed build of Red Hat Enterprise Linux for IBM Power can boot pre-production kernels
Product: [Other] Security Response Reporter: Marco Benatto <mbenatto>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, bhu, ddepaula, dvlasenk, hkrzesin, jarod, jburrell, jfaracco, jferlan, jforbes, joe.lawrence, jshortt, jstancek, kcarcia, kernel-mgr, lzampier, nmurray, ptalbert, rvrbovsk, scweaver, vkumar, walters
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel, where a set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture were signed with Red Hat's production secure boot keys. This issue allows kernel versions targeted for testing to eventually boot in PowerPC environments with the Secure Boot feature enabled. An attacker needs high privilege to install the non-production kernel packages in the target machine and make it the default boot option on grub2.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2098231    
Bug Blocks: 2069244    

Description Marco Benatto 2022-05-23 22:49:51 UTC 
A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it shouldn't. These kernel builds don't have the secure boot lockdown patches applied to it and can bypass the secure boot validations, allowing the attacker to load another non-trusted code.
Comment 5 Marco Benatto 2022-08-17 18:30:01 UTC 
A flaw was found in the Linux kernel, where a set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture were signed with Red Hat's production secure boot keys. This issue allows kernel versions targeted for testing to eventually boot in PowerPC environments with the Secure Boot feature enabled. An attacker needs high privilege to install the non-production kernel packages in the target machine and make it the default boot option on grub2.