#47185 - grub2 package is vulnerable to CVE-2020-14372, CVE-2020-25632, CVE-2020-25647, CVE-2020-27749, CVE-2020-27779, CVE-2021-20225, CVE-2021-20233 and CVE-2021-3418

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #14 received at 47185@debbugs.gnu.org (full text, mbox, reply):

Received: (at 47185) by debbugs.gnu.org; 16 Mar 2021 23:49:23 +0000
From debbugs-submit-bounces@debbugs.gnu.org Tue Mar 16 19:49:23 2021
Received: from localhost ([127.0.0.1]:41480 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1lMJRD-0007br-07
	for submit@debbugs.gnu.org; Tue, 16 Mar 2021 19:49:23 -0400
Received: from world.peace.net ([64.112.178.59]:51518)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <mhw@netris.org>) id 1lMJRA-0007bd-Mv
 for 47185@debbugs.gnu.org; Tue, 16 Mar 2021 19:49:21 -0400
Received: from mhw by world.peace.net with esmtpsa
 (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92)
 (envelope-from <mhw@netris.org>)
 id 1lMJR4-0000cI-EE; Tue, 16 Mar 2021 19:49:14 -0400
From: Mark H Weaver <mhw@netris.org>
To: Léo Le Bouter <lle-bout@zaclys.net>, 47185@debbugs.gnu.org
Subject: Re: bug#47185: grub2 package is vulnerable to CVE-2020-14372,
 CVE-2020-25632, CVE-2020-25647, CVE-2020-27749, CVE-2020-27779,
 CVE-2021-20225, CVE-2021-20233 and CVE-2021-3418
In-Reply-To: <3de2a6393156da40334d95993e15b22ca0eae5df.camel@zaclys.net>
References: <ba69ba4020b40dfa182174ea2395cf17195512d5.camel@zaclys.net>
 <3de2a6393156da40334d95993e15b22ca0eae5df.camel@zaclys.net>
Date: Tue, 16 Mar 2021 19:47:43 -0400
Message-ID: <87pmzyirt1.fsf@netris.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 47185
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

Hi Léo,

Léo Le Bouter via Bug reports for GNU Guix <bug-guix@gnu.org> writes:
> NOTE: SecureBoot on GNU Guix is not something common at all, so the
> urgency to fix this issue is not as great as if we explicitly
> advertised support for SecureBoot.

I would go further and question whether *anyone* is using SecureBoot
with a Guix system, and moreover whether its feasible to do without
non-trivial development work.

> This looks like a sizeable upgrade to a sensitive part of GNU Guix, so
> we have to test carefully.

Indeed.  I would like to underline this point: GRUB is the only part of
a Guix system that cannot be easily rolled back if it breaks.  If we
make changes to GRUB that causes breakage for some minority of users,
those users could end up with an unbootable system, requiring the use of
a rescue disk to repair.

Therefore, we should be *very* careful about updating our GRUB package,
especially for the sake of bugs that almost certainly do not affect Guix
users.

I think we should refrain from updating GRUB until there's an official
upstream stable release.  Even then, I would advise making an effort to
test it on Guix systems, using several different system configurations,
before pushing it to 'master'.

What do you think?

      Regards,
        Mark

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sun Dec 22 10:59:04 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#47185 grub2 package is vulnerable to CVE-2020-14372, CVE-2020-25632, CVE-2020-25647, CVE-2020-27749, CVE-2020-27779, CVE-2021-20225, CVE-2021-20233 and CVE-2021-3418