[SECURITY PATCH 1/8] kern/rescue_reader: Block the rescue mode until the CLI authentication - Daniel Kiper via Grub-devel

From: Daniel Kiper via Grub-devel <grub-devel@gnu.org>
To: grub-devel@gnu.org
Cc: Daniel Kiper <daniel.kiper@oracle.com>,
	dfirblog@gmail.com, eworm@archlinux.org, glin@suse.com,
	mbenatto@redhat.com, mchang@suse.com, meissner@suse.com,
	tpowa@archlinux.org
Subject: [SECURITY PATCH 1/8] kern/rescue_reader: Block the rescue mode until the CLI authentication
Date: Thu,  8 May 2025 19:02:07 +0200	[thread overview]
Message-ID: <20250508170214.26577-2-daniel.kiper@oracle.com> (raw)
In-Reply-To: <20250508170214.26577-1-daniel.kiper@oracle.com>

From: Maxim Suhanov <dfirblog@gmail.com>

This further mitigates potential misuse of the CLI after the
root device has been successfully unlocked via TPM.

Fixes: CVE-2025-4382

Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
 grub-core/kern/rescue_reader.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/grub-core/kern/rescue_reader.c b/grub-core/kern/rescue_reader.c
index 4259857ba..a71ada8fb 100644
--- a/grub-core/kern/rescue_reader.c
+++ b/grub-core/kern/rescue_reader.c
@@ -79,7 +79,7 @@ void __attribute__ ((noreturn))
 grub_rescue_run (void)
 {
   /* Stall if the CLI has been disabled */
-  if (grub_is_cli_disabled ())
+  if (grub_is_cli_disabled () || grub_is_cli_need_auth ())
     {
       grub_printf ("Rescue mode has been disabled...\n");
 
-- 
2.11.0


_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel
