0-Day GRUB2 Authentication Bypass Hits Linux (hmarco.org)

Posted by Soulskill on Wednesday December 16, 2015 @01:22AM from the caught-and-fixed dept.

prisoninmate writes: A zero-day security flaw was discovered by developers Ismael Ripoll and Hector Marco in the upstream GRUB2 packages. GRUB2 did not correctly handle the backspace key when the bootloader was configured to use password protected authentication, thus allowing a local attacker to bypass GRUB's password protection. Versions from 1.98 (December, 2009) to 2.02 (December, 2015) are affected. At the moment, it looks like only a few distributions received the patched GRUB2 versions, including Ubuntu, Debian (Squeeze LTS only) and Red Hat Enterprise Linux 7.

1 of 144 comments (clear)

Min score:

Reason:

Sort:

What about systemd-grub? by Anonymous Coward · 2015-12-16 01:40 · Score: 5, Funny

The new systemd-grub leverages a pre-boot, machine-level dbus interface to policy-kit and systemd-logind, which will handle this for you. Why are people still in the dark ages with bootloader passwords?