** Changed in: grub2 (Ubuntu Disco)
Status: In Progress => Fix Committed
** Changed in: grub2 (Ubuntu Bionic)
Status: In Progress => Fix Committed
** Changed in: grub2 (Ubuntu Disco)
Assignee: (unassigned) => dann frazier (dannf)
** Changed in: grub2 (Ubuntu Bionic)
Assignee: (unassigned) => dann frazier (dannf)
** Description changed:
[Impact]
A devicetree command could be used to load an unsigned device tree file,
which will override the hardware configuration exposed to the kernel. This
could potentially be used to subvert Secure Boot.
[Test Case]
grub> devicetree foo
error: Secure Boot forbids loading devicetree from foo.
[Regression Risk]
The idea of Secure Boot and externally provided devicetree are inherently
incompatible - there's no known system that requires this config, but it is of
course possible someone somewhere is doing it.
+
+ The code involved is restricted to devicetree code, so impact would be
+ restricted to ARM systems.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1851897
Title:
devicetree command should be disabled in Secure Boot mode
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1851897/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
