bugGNU GRUB - Bugs: bug #62846, Failed to boot compressed kernel...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #62846: Failed to boot compressed kernel when secure boot is enabled

Submitter:  Qiumiao Zhang <century6>
Submitted:  Mon 01 Aug 2022 02:25:22 AM UTC
   
 
Category:  Booting Severity:  Major
Priority:  5 - Normal Item Group:  Software Error
Status:  None Privacy:  Public
Assigned to:  None Originator Name:  Qiumiao Zhang
Open/Closed:  Open Release:  Git master
Release:  Reproducibility:  Every Time
Planned Release:  None

Mon 01 Aug 2022 03:08:23 AM UTC, comment #1: 

This patch creates a problem for other verifiers. Both technical and security. Technical is that other verifiers use file contents before applying any transformation. The security problem is that compressors are not verified to be secure, they are large and complex. If EFI needs a special order it's better to have it as a separate filter.

 Vladimir Serbinenko <phcoder>
Group administrator
Mon 01 Aug 2022 02:25:22 AM UTC, original submission:  

Versions affected: 2.06
Reproduced on: UEFI & secure boot
Tested on: QEMU virtual machine (aarch64) with Linux

When I tried to boot the gzip compressed kernel through grub2, shim could not verify the signature of the kernel. I think the reason for this problem is that grub2 always handles the kernel in a fixed order: try to verify it first, and then try to decompress it. When building the kernel, we have to sign the kernel first and then compress it, because compressed files cannot be signed. In this case, grub2 should try to decompress the kernel first, and then verify its signature.

A minor patch could fix it, please see the attachment.

 Qiumiao Zhang <century6>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #53493:  verifiers-Fix-compressed-kernel-verification-failed.patch added by century6 (986B - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by phcoder (Posted a comment)
  • -email is unavailable- added by century6 (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-08-01 century6 Attached File- Added verifiers-Fix-compressed-kernel-verification-failed.patch, #53493

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-3b9d.
    Corresponding source code