bugGNU GRUB - Bugs: bug #47432, GRUB edition can allow an user to...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #47432: GRUB edition can allow an user to have any privilege it wants

Submitted by:  -Deleted Account- <johngoes>
Submitted on:  Wed 16 Mar 2016 08:27:34 PM UTC  
Votes:  100  
 
Category: SecuritySeverity: Major
Priority: 5 - NormalItem Group: Action Request
Status: InvalidPrivacy: Public
Assigned to: NoneOriginator Name: João Otávio de Góes & Giovanni C Martins
Open/Closed: ClosedRelease: 
Release: 2.02~beta1Reproducibility: Every Time
Planned Release: None

(Jump to the original submission Jump to the original submission)

Sun 10 Apr 2016 03:33:54 PM UTC, comment #7:

From a "readme" during the installation, or just asking to set a password in the installation.

-Deleted Account- <johngoes>
Sun 10 Apr 2016 08:34:54 AM UTC, comment #6:

And where those default passwords should come from?

Andrei Borzenkov <arvidjaar>
Project Member
Thu 31 Mar 2016 05:59:00 PM UTC, comment #5:

Exactly, @arvidjaar. Otherwise, this is a security flaw either way.

-Deleted Account- <johngoes>
Thu 31 Mar 2016 04:41:46 PM UTC, comment #4:

Sorry, your reply ended in spam. I'm afraid I do not understand what you mean. Do you suggest having GRUB password enabled by default or what?

Andrei Borzenkov <arvidjaar>
Project Member
Thu 17 Mar 2016 01:18:23 PM UTC, comment #3:

That's a security issue either way. After all, there's no pattern on this setting (like putting password lock on). I mean, there's no way every user can set this password and at the same time be away from this severe flaw.
But that's a good resource, then, I change my suggestion of solution, why can't be fixed (standard) the password setting? (of course we can allow the user to change it in the GRUB installation, or something)

-Deleted Account- <johngoes>
Thu 17 Mar 2016 08:10:51 AM UTC, comment #2:

You can restrict access to menu editing with password authentication in GRUB. What happens after kernel is loaded is outside of GRUB scope.

Andrei Borzenkov <arvidjaar>
Project Member
Wed 16 Mar 2016 08:59:20 PM UTC, comment #1:

That's awesome! Greatly relevant.

Giovanni Custódio Martins <gioexpert>
Wed 16 Mar 2016 08:27:34 PM UTC, original submission:

Submitted by Giovanni Custódio Martins and João Otávio de Góes.
Date: 16/02/2016 15:32:11
Posted on: 16/03/2016 04:50:50 PM GMT

Tested version: GNU GRUB 2.02 beta 2-22+deb8u1 <

Machine architecture: Intel Core i5 - 4200Um 1.6GHz, 8GB RAM, HDD 500GB, multiboot system; Intel Pentium 2117U, 1.80GHz (dual core), 4GB RAM, 250GB, virtual machine emulated system.

Tested target systems: Kali Linux 2.0, Kali Linux 1.0 and Windows (10).

Priority: Severe (major)

Primary effect: bypassing login (changing password of a Linux's account)

Secondary effect: having access (as a privileged user) to all data/files/directories of the system

Main effect: having permission to modify/remove/add/execute anything you want in the system (that you wouldn't have access to it, without the password).

Date: 16/02/2016 15:32:11

Flaw view: When accessing GNU GRUB it's possible to see what systems you can boot. Pressing "e" you have access to the "advanced" settings of the boot option. In the "settings" you can edit the line "linux /boot/vmlinuz-4.0.0-kali1-amd64 root=UUID=f\cd578e80739f-42c8-b3ab-f4f6b602b776 ro initrd=/install/gtk/initrd.gz" to "linux /boot/vmlinuz-4.0.0-kali1-amd64 root=UUID=f\cd578e80739f-42c8-b3ab-f4f6b602b776 rw init=/bin/bash", by doing this, it will prompt you a bash screen (terminal) and then, you can change all system's settings (including user password, removing directories and even corrupting the system!

Solving Suggestion: attributing fixed low permissions to the bash when not logged in the system. It means: not having permission to view the data in directories and not changing system's settings (like the password).

-Deleted Account- <johngoes>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by arvidjaar (Posted a comment)
  • -unavailable- added by gioexpert (Posted a comment)
  • -unavailable- added by gioexpert (Voted in favor of this item)
  • -unavailable- added by johngoes (Submitted the item)
  • -unavailable- added by johngoes (Discovered by João Otávio de Góes & Giovanni Custódio Martins)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 100 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 17 Mar 2016 08:10:51 AM UTCarvidjaarStatusNone=>Invalid
      Open/ClosedOpen=>Closed
    Wed 16 Mar 2016 08:57:34 PM UTCgioexpertCarbon-Copy-=>Added gioexpert
    Wed 16 Mar 2016 08:27:34 PM UTCjohngoesCarbon-Copy-=>Added johngoes

    Back to the top


    Powered by Savane 3.1-cleanup1