Bug 2300167

Summary:	linux-firmware: PKfail secure boot bypass [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Robb Gatica <rgatica>
Component:	linux-firmware	Assignee:	David Woodhouse <dwmw2>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	high
Version:	40	CC:	dwmw2, jforbes, jwboyer, kernel-maint, laura, pbrobinson
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["f91d338b-22f6-48d8-9edc-87e9691862f0"]}
Fixed In Version:		Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-07-29 11:52:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2300165

Description Robb Gatica 2024-07-26 22:13:40 UTC

More information about this security flaw is available in the following bug:

https://bugzilla.redhat.com/show_bug.cgi?id=2300165

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Comment 1 Peter Robinson 2024-07-29 11:52:59 UTC

PKfail isn't part of linux-firmware, it's device UEFI early boot firmware, that is *NEVER* shipped as part of linux-firmware, which provides peripheral device firmware like GPU and WiFi firmware.

The PrivateKey was a AMI key.

This bug is actually completely wrong, it can't addressed by updating linux-firmware, it can only be addressed by updated early boot firmware which could be updated using fwupdmgr if supported by the device.

Can we please do some research on firmware security bugs and how they related  to linux-firmware as we have of late been getting a *LOT* of false positives by Red Hat security response.