34 lines
1.0 KiB
Diff
34 lines
1.0 KiB
Diff
From 4f45e963ea913000fd8e3fe20f9afb3722073cea Mon Sep 17 00:00:00 2001
|
|
From: Maxim Suhanov <dfirblog@gmail.com>
|
|
Date: Thu, 8 May 2025 19:02:07 +0200
|
|
Subject: [PATCH 1/8] kern/rescue_reader: Block the rescue mode until the CLI
|
|
authentication
|
|
|
|
This further mitigates potential misuse of the CLI after the
|
|
root device has been successfully unlocked via TPM.
|
|
|
|
Fixes: CVE-2025-4382
|
|
|
|
Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
|
|
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
---
|
|
grub-core/kern/rescue_reader.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/grub-core/kern/rescue_reader.c b/grub-core/kern/rescue_reader.c
|
|
index 4259857ba9..a71ada8fb7 100644
|
|
--- a/grub-core/kern/rescue_reader.c
|
|
+++ b/grub-core/kern/rescue_reader.c
|
|
@@ -79,7 +79,7 @@ void __attribute__ ((noreturn))
|
|
grub_rescue_run (void)
|
|
{
|
|
/* Stall if the CLI has been disabled */
|
|
- if (grub_is_cli_disabled ())
|
|
+ if (grub_is_cli_disabled () || grub_is_cli_need_auth ())
|
|
{
|
|
grub_printf ("Rescue mode has been disabled...\n");
|
|
|
|
--
|
|
2.49.0
|
|
|