From 4f45e963ea913000fd8e3fe20f9afb3722073cea Mon Sep 17 00:00:00 2001 From: Maxim Suhanov Date: Thu, 8 May 2025 19:02:07 +0200 Subject: [PATCH 1/8] kern/rescue_reader: Block the rescue mode until the CLI authentication This further mitigates potential misuse of the CLI after the root device has been successfully unlocked via TPM. Fixes: CVE-2025-4382 Signed-off-by: Maxim Suhanov Reviewed-by: Daniel Kiper --- grub-core/kern/rescue_reader.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/grub-core/kern/rescue_reader.c b/grub-core/kern/rescue_reader.c index 4259857ba9..a71ada8fb7 100644 --- a/grub-core/kern/rescue_reader.c +++ b/grub-core/kern/rescue_reader.c @@ -79,7 +79,7 @@ void __attribute__ ((noreturn)) grub_rescue_run (void) { /* Stall if the CLI has been disabled */ - if (grub_is_cli_disabled ()) + if (grub_is_cli_disabled () || grub_is_cli_need_auth ()) { grub_printf ("Rescue mode has been disabled...\n"); -- 2.49.0