Bug 1886285 (CVE-2020-26541) - CVE-2020-26541 kernel: security bypass in certs/blacklist.c and certs/system_keyring.c
Summary: CVE-2020-26541 kernel: security bypass in certs/blacklist.c and certs/system_...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-26541
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1890097 1890098 1890099 1890100 1890101 1890102 1890103 1886287 1893793 1893794 1893795 1906358 1906359 1906360 1906361 1906362 1911193 1965270 1965271
Blocks: 1886288
TreeView+ depends on / blocked
 
Reported: 2020-10-08 06:21 UTC by Dhananjay Arunesh
Modified: 2023-05-12 21:18 UTC (History)
50 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel in certs/blacklist.c, When signature entries for EFI_CERT_X509_GUID are contained in the Secure Boot Forbidden Signature Database, the entries are skipped. This can cause a security threat and breach system integrity, confidentiality and even lead to a denial of service problem.
Clone Of:
Environment:
Last Closed: 2021-06-29 16:40:35 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:2570 0 None None None 2021-06-29 16:28:16 UTC
Red Hat Product Errata RHSA-2021:2599 0 None None None 2021-06-29 15:26:42 UTC
Red Hat Product Errata RHSA-2021:2666 0 None None None 2021-07-07 14:52:57 UTC
Red Hat Product Errata RHSA-2021:2718 0 None None None 2021-07-20 22:10:32 UTC
Red Hat Product Errata RHSA-2021:2719 0 None None None 2021-07-20 21:27:31 UTC

Description Dhananjay Arunesh 2020-10-08 06:21:18 UTC 
A flaw was found in the Linux kernel in certs/blacklist.c, When signature entries for EFI_CERT_X509_GUID are contained in the Secure Boot Forbidden Signature Database, the entries are skipped. This can cause a security threat and breach system integrity, confidentiality and even lead to a denial of service problem.

The Linux kernel does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism.

References:
https://lkml.org/lkml/2020/9/15/1871
Comment 1 Dhananjay Arunesh 2020-10-08 06:23:58 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1886287]
Comment 6 Rohit Keshri 2020-11-03 16:16:38 UTC 
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Comment 24 errata-xmlrpc 2021-06-29 15:26:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:2599 https://access.redhat.com/errata/RHSA-2021:2599
Comment 25 errata-xmlrpc 2021-06-29 16:28:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:2570 https://access.redhat.com/errata/RHSA-2021:2570
Comment 26 Product Security DevOps Team 2021-06-29 16:40:35 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-26541
Comment 27 errata-xmlrpc 2021-07-07 14:52:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:2666 https://access.redhat.com/errata/RHSA-2021:2666
Comment 28 errata-xmlrpc 2021-07-20 21:27:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:2719 https://access.redhat.com/errata/RHSA-2021:2719
Comment 29 errata-xmlrpc 2021-07-20 22:10:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:2718 https://access.redhat.com/errata/RHSA-2021:2718
Note You need to log in before you can comment on or make changes to this bug.