[SECURITY PATCH 1/8] kern/rescue_reader: Block the rescue mode until the CLI authentication

[SECURITY PATCH 1/8] kern/rescue_reader: Block the rescue mode until the CLI authentication

[Daniel Kiper via Grub-devel]

From: Maxim Suhanov <dfirblog@gmail.com>

This further mitigates potential misuse of the CLI after the
root device has been successfully unlocked via TPM.

Fixes: CVE-2025-4382

Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
 grub-core/kern/rescue_reader.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/grub-core/kern/rescue_reader.c b/grub-core/kern/rescue_reader.c
index 4259857ba..a71ada8fb 100644
--- a/grub-core/kern/rescue_reader.c
+++ b/grub-core/kern/rescue_reader.c
@@ -79,7 +79,7 @@ void __attribute__ ((noreturn))
 grub_rescue_run (void)
 {
   /* Stall if the CLI has been disabled */
-  if (grub_is_cli_disabled ())
+  if (grub_is_cli_disabled () || grub_is_cli_need_auth ())
     {
       grub_printf ("Rescue mode has been disabled...\n");
 
-- 
2.11.0


_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

[SECURITY PATCH 00/08] GRUB2 vulnerabilities - 2025/05/08

[Daniel Kiper via Grub-devel]

Hi all,

This patch set contains a bundle of fixes for various security flaws
discovered, as part of a pro-active hardening effort, in the GRUB2 code
recently. The most severe one, i.e. potentially exploitable, has CVE
assigned and is listed at the end of this email.

Details of exactly what needs updating will be provided by the respective
distros and vendors when updates become available.

Full mitigation against CVE will require updated shim with latest SBAT
(Secure Boot Advanced Targeting) [1] data provided by distros and vendors.
This time UEFI revocation list (dbx) will not be used and revocation of broken
artifacts will be done with SBAT only. For information on how to apply the
latest SBAT revocations, please see mokutil(1). Vendor shims may explicitly
permit known older boot artifacts to boot.

Updated GRUB2, shim and other boot artifacts from all the affected vendors will
be made available when the embargo lifts or some time thereafter.

I am posting all the GRUB2 upstream patches which fix all security bugs found
and reported up until now. Affected Linux distros carry or will carry soon one
form or another of these patches. Now all the GRUB2 upstream patches are in
the GRUB2 git repository [2] too.

I would like to thank Maxim Suhanov for responsible disclosure and preparation
of patches needed to fix known issues. Michael Chang has been helping with
fixing and testing the patches. Thank you!

Daniel

[1] https://github.com/rhboot/shim/blob/main/SBAT.md
    https://github.com/rhboot/shim/blob/main/Delivering_Sbat_Revocations.md

[2] https://git.savannah.gnu.org/gitweb/?p=grub.git
    https://git.savannah.gnu.org/git/grub.git

*******************************************************************************

CVE-2025-4382: GRUB allows access to encrypted device through CLI once root device is unlocked via TPM
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - 5.9

A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured
for TPM-based auto-decryption. When GRUB is set to automatically decrypt disks
using keys stored in the TPM, it reads the decryption key into system memory.
If an attacker with physical access can corrupt the underlying filesystem
superblock, GRUB will fail to locate a valid filesystem and enter rescue mode.
At this point, the disk is already decrypted, and the decryption key remains
loaded in system memory. This scenario may allow an attacker with physical
access to access the unencrypted data without any further authentication,
thereby compromising data confidentiality. Furthermore, the ability to force
this state through filesystem corruption also presents a data integrity concern.

Reported-by: Maxim Suhanov

*******************************************************************************

 docs/grub.texi                   | 32 +++++++++++++++++++++++++++++++-
 grub-core/commands/minicmd.c     | 11 +++++++++++
 grub-core/commands/search.c      | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 grub-core/commands/search_wrap.c |  7 ++++++-
 grub-core/disk/cryptodisk.c      | 29 +++++++++++++++++++++++++++++
 grub-core/disk/diskfilter.c      | 88 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 grub-core/kern/rescue_reader.c   |  2 +-
 grub-core/normal/main.c          |  3 ++-
 include/grub/cryptodisk.h        |  1 +
 include/grub/search.h            |  7 ++++---
 10 files changed, 228 insertions(+), 7 deletions(-)

Maxim Suhanov (7):
      kern/rescue_reader: Block the rescue mode until the CLI authentication
      commands/search: Introduce the --cryptodisk-only argument
      disk/diskfilter: Introduce the "cryptocheck" command
      commands/search: Add the diskfilter support
      docs: Document available crypto disks checks
      disk/cryptodisk: Add the "erase secrets" function
      disk/cryptodisk: Wipe the passphrase from memory

Michael Chang (1):
      cryptocheck: Add --quiet option


_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

[SECURITY PATCH 1/8] kern/rescue_reader: Block the rescue mode until the CLI authentication

[Daniel Kiper via Grub-devel]

From: Maxim Suhanov <dfirblog@gmail.com>

This further mitigates potential misuse of the CLI after the
root device has been successfully unlocked via TPM.

Fixes: CVE-2025-4382

Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
 grub-core/kern/rescue_reader.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/grub-core/kern/rescue_reader.c b/grub-core/kern/rescue_reader.c
index 4259857ba..a71ada8fb 100644
--- a/grub-core/kern/rescue_reader.c
+++ b/grub-core/kern/rescue_reader.c
@@ -79,7 +79,7 @@ void __attribute__ ((noreturn))
 grub_rescue_run (void)
 {
   /* Stall if the CLI has been disabled */
-  if (grub_is_cli_disabled ())
+  if (grub_is_cli_disabled () || grub_is_cli_need_auth ())
     {
       grub_printf ("Rescue mode has been disabled...\n");
 
-- 
2.11.0


_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

[SECURITY PATCH 2/8] commands/search: Introduce the --cryptodisk-only argument

[Daniel Kiper via Grub-devel]

From: Maxim Suhanov <dfirblog@gmail.com>

This allows users to restrict the "search" command's scope to
encrypted disks only.

Typically, this command is used to "rebase" $root and $prefix
before loading additional configuration files via "source" or
"configfile". Unfortunately, this leads to security problems,
like CVE-2023-4001, when an unexpected, attacker-controlled
device is chosen by the "search" command.

The --cryptodisk-only argument allows users to ensure that the
file system picked is encrypted.

This feature supports the CLI authentication, blocking bypass
attempts.

Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
 grub-core/commands/search.c      | 20 ++++++++++++++++++++
 grub-core/commands/search_wrap.c |  7 ++++++-
 grub-core/normal/main.c          |  3 ++-
 include/grub/search.h            |  7 ++++---
 4 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c
index 263f1501c..f6bfef958 100644
--- a/grub-core/commands/search.c
+++ b/grub-core/commands/search.c
@@ -86,6 +86,26 @@ iterate_device (const char *name, void *data)
       grub_device_close (dev);
     }
 
+  /* Limit to encrypted disks when requested. */
+  if (ctx->flags & SEARCH_FLAGS_CRYPTODISK_ONLY)
+    {
+      grub_device_t dev;
+
+      dev = grub_device_open (name);
+      if (dev == NULL)
+	{
+	  grub_errno = GRUB_ERR_NONE;
+	  return 0;
+	}
+      if (dev->disk == NULL || dev->disk->dev->id != GRUB_DISK_DEVICE_CRYPTODISK_ID)
+	{
+	  grub_device_close (dev);
+	  grub_errno = GRUB_ERR_NONE;
+	  return 0;
+	}
+      grub_device_close (dev);
+    }
+
 #ifdef DO_SEARCH_FS_UUID
 #define compare_fn grub_strcasecmp
 #else
diff --git a/grub-core/commands/search_wrap.c b/grub-core/commands/search_wrap.c
index 318581f3b..5f536006c 100644
--- a/grub-core/commands/search_wrap.c
+++ b/grub-core/commands/search_wrap.c
@@ -41,6 +41,7 @@ static const struct grub_arg_option options[] =
      ARG_TYPE_STRING},
     {"no-floppy",	'n', 0, N_("Do not probe any floppy drive."), 0, 0},
     {"efidisk-only",	0, 0, N_("Only probe EFI disks."), 0, 0},
+    {"cryptodisk-only",	0, 0, N_("Only probe encrypted disks."), 0, 0},
     {"hint",	        'h', GRUB_ARG_OPTION_REPEATABLE,
      N_("First try the device HINT. If HINT ends in comma, "
 	"also try subpartitions"), N_("HINT"), ARG_TYPE_STRING},
@@ -75,6 +76,7 @@ enum options
     SEARCH_SET,
     SEARCH_NO_FLOPPY,
     SEARCH_EFIDISK_ONLY,
+    SEARCH_CRYPTODISK_ONLY,
     SEARCH_HINT,
     SEARCH_HINT_IEEE1275,
     SEARCH_HINT_BIOS,
@@ -189,6 +191,9 @@ grub_cmd_search (grub_extcmd_context_t ctxt, int argc, char **args)
   if (state[SEARCH_EFIDISK_ONLY].set)
     flags |= SEARCH_FLAGS_EFIDISK_ONLY;
 
+  if (state[SEARCH_CRYPTODISK_ONLY].set)
+    flags |= SEARCH_FLAGS_CRYPTODISK_ONLY;
+
   if (state[SEARCH_LABEL].set)
     grub_search_label (id, var, flags, hints, nhints);
   else if (state[SEARCH_FS_UUID].set)
@@ -210,7 +215,7 @@ GRUB_MOD_INIT(search)
   cmd =
     grub_register_extcmd ("search", grub_cmd_search,
 			  GRUB_COMMAND_FLAG_EXTRACTOR | GRUB_COMMAND_ACCEPT_DASH,
-			  N_("[-f|-l|-u|-s|-n] [--hint HINT [--hint HINT] ...]"
+			  N_("[-f|-l|-u|-s|-n] [--cryptodisk-only] [--hint HINT [--hint HINT] ...]"
 			     " NAME"),
 			  N_("Search devices by file, filesystem label"
 			     " or filesystem UUID."
diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
index 04d058f55..96abfda2f 100644
--- a/grub-core/normal/main.c
+++ b/grub-core/normal/main.c
@@ -511,7 +511,8 @@ static const char *features[] = {
   "feature_chainloader_bpb", "feature_ntldr", "feature_platform_search_hint",
   "feature_default_font_path", "feature_all_video_module",
   "feature_menuentry_id", "feature_menuentry_options", "feature_200_final",
-  "feature_nativedisk_cmd", "feature_timeout_style"
+  "feature_nativedisk_cmd", "feature_timeout_style",
+  "feature_search_cryptodisk_only"
 };
 
 GRUB_MOD_INIT(normal)
diff --git a/include/grub/search.h b/include/grub/search.h
index ffd2411ca..3eabaf0cc 100644
--- a/include/grub/search.h
+++ b/include/grub/search.h
@@ -21,9 +21,10 @@
 
 enum search_flags
   {
-    SEARCH_FLAGS_NONE		= 0,
-    SEARCH_FLAGS_NO_FLOPPY	= 1,
-    SEARCH_FLAGS_EFIDISK_ONLY	= 2
+    SEARCH_FLAGS_NONE            = 0,
+    SEARCH_FLAGS_NO_FLOPPY       = 1,
+    SEARCH_FLAGS_EFIDISK_ONLY    = 2,
+    SEARCH_FLAGS_CRYPTODISK_ONLY = 4
   };
 
 void grub_search_fs_file (const char *key, const char *var,
-- 
2.11.0


_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

[SECURITY PATCH 3/8] disk/diskfilter: Introduce the "cryptocheck" command

[Daniel Kiper via Grub-devel]

From: Maxim Suhanov <dfirblog@gmail.com>

This command examines a given diskfilter device, e.g., an LVM disk,
and checks if underlying disks, physical volumes, are cryptodisks,
e.g., LUKS disks, this layout is called "LVM-on-LUKS".

The return value is 0 when all underlying disks (of a given device)
are cryptodisks (1 if at least one disk is unencrypted or in an
unknown state).

Users are encouraged to include the relevant check before loading
anything from an LVM disk that is supposed to be encrypted.

This further supports the CLI authentication, blocking bypass
attempts when booting from an encrypted LVM disk.

Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
 grub-core/disk/diskfilter.c | 75 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 75 insertions(+)

diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c
index cc5062691..9eda22e3f 100644
--- a/grub-core/disk/diskfilter.c
+++ b/grub-core/disk/diskfilter.c
@@ -20,6 +20,7 @@
 #include <grub/dl.h>
 #include <grub/disk.h>
 #include <grub/mm.h>
+#include <grub/command.h>
 #include <grub/err.h>
 #include <grub/misc.h>
 #include <grub/diskfilter.h>
@@ -1377,6 +1378,73 @@ grub_diskfilter_get_pv_from_disk (grub_disk_t disk,
 }
 #endif
 
+static int
+grub_diskfilter_check_pvs_encrypted (grub_disk_t disk, int *pvs_cnt)
+{
+  struct grub_diskfilter_lv *lv = disk->data;
+  struct grub_diskfilter_pv *pv;
+
+  *pvs_cnt = 0;
+
+  if (lv->vg->pvs)
+    for (pv = lv->vg->pvs; pv; pv = pv->next)
+      {
+        (*pvs_cnt)++;
+
+        if (pv->disk == NULL)
+          {
+            /* Can be a partially activated VG, bail out. */
+            return GRUB_ERR_TEST_FAILURE;
+          }
+
+        if (pv->disk->dev->id != GRUB_DISK_DEVICE_CRYPTODISK_ID)
+          {
+            /* All backing devices must be cryptodisks, stop. */
+            return GRUB_ERR_TEST_FAILURE;
+          }
+      }
+  return GRUB_ERR_NONE;
+}
+
+static grub_err_t
+grub_cmd_cryptocheck (grub_command_t cmd __attribute__ ((unused)),
+               int argc, char **args)
+{
+  grub_disk_t disk;
+  int check_pvs_res;
+  int namelen;
+  int pvs_cnt;
+
+  if (argc != 1)
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("disk name expected"));
+
+  namelen = grub_strlen (args[0]);
+  if (namelen > 2 && (args[0][0] == '(') && (args[0][namelen - 1] == ')'))
+    args[0][namelen - 1] = 0;
+  else
+    return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("invalid disk: %s"),
+                       args[0]);
+
+  if (!is_valid_diskfilter_name (&args[0][1]))
+    return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("unrecognized disk: %s"),
+                       &args[0][1]);
+
+  disk = grub_disk_open (&args[0][1]);
+  if (disk == NULL)
+    return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("no such disk: %s"),
+                       &args[0][1]);
+
+  check_pvs_res = grub_diskfilter_check_pvs_encrypted (disk, &pvs_cnt);
+  grub_disk_close (disk);
+
+  grub_printf("%s is %sencrypted (%d pv%s examined)\n", &args[0][1],
+              (check_pvs_res == GRUB_ERR_NONE) ? "" : "un",
+              pvs_cnt,
+              (pvs_cnt > 1) ? "s" : "");
+
+  return check_pvs_res;
+}
+
 static struct grub_disk_dev grub_diskfilter_dev =
   {
     .name = "diskfilter",
@@ -1393,14 +1461,21 @@ static struct grub_disk_dev grub_diskfilter_dev =
     .next = 0
   };
 
+static grub_command_t cmd;
+
 \f
 GRUB_MOD_INIT(diskfilter)
 {
   grub_disk_dev_register (&grub_diskfilter_dev);
+  cmd = grub_register_command ("cryptocheck", grub_cmd_cryptocheck,
+                                N_("DEVICE"),
+                                N_("Check if a logical volume resides on encrypted disks."));
 }
 
 GRUB_MOD_FINI(diskfilter)
 {
   grub_disk_dev_unregister (&grub_diskfilter_dev);
+  if (cmd != NULL)
+    grub_unregister_command (cmd);
   free_array ();
 }
-- 
2.11.0


_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

[SECURITY PATCH 4/8] commands/search: Add the diskfilter support

[Daniel Kiper via Grub-devel]

From: Maxim Suhanov <dfirblog@gmail.com>

When the --cryptodisk-only argument is given, also check the target
device using the "cryptocheck" command, if available.

This extends the checks to common layouts like LVM-on-LUKS, so the
--cryptodisk-only argument transparently handles such setups.

Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
 grub-core/commands/search.c | 32 +++++++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c
index f6bfef958..185c1e70f 100644
--- a/grub-core/commands/search.c
+++ b/grub-core/commands/search.c
@@ -54,6 +54,36 @@ struct search_ctx
   int is_cache;
 };
 
+static bool
+is_unencrypted_disk (grub_disk_t disk)
+{
+  grub_command_t cmd;
+  char *disk_str;
+  int disk_str_len;
+  int res;
+
+  if (disk->dev->id == GRUB_DISK_DEVICE_CRYPTODISK_ID)
+    return false; /* This is (crypto) disk. */
+
+  if (disk->dev->id == GRUB_DISK_DEVICE_DISKFILTER_ID)
+    {
+      cmd = grub_command_find ("cryptocheck");
+      if (cmd == NULL) /* No diskfilter module loaded for some reason. */
+        return true;
+
+      disk_str_len = grub_strlen (disk->name) + 2 + 1;
+      disk_str = grub_malloc (disk_str_len);
+      if (disk_str == NULL) /* Something is wrong, better report as unencrypted. */
+        return true;
+
+      grub_snprintf (disk_str, disk_str_len, "(%s)", disk->name);
+      res = cmd->func (cmd, 1, &disk_str);
+      grub_free (disk_str);
+      return (res != GRUB_ERR_NONE) ? true : false; /* GRUB_ERR_NONE for encrypted. */
+    }
+  return true;
+}
+
 /* Helper for FUNC_NAME.  */
 static int
 iterate_device (const char *name, void *data)
@@ -97,7 +127,7 @@ iterate_device (const char *name, void *data)
 	  grub_errno = GRUB_ERR_NONE;
 	  return 0;
 	}
-      if (dev->disk == NULL || dev->disk->dev->id != GRUB_DISK_DEVICE_CRYPTODISK_ID)
+      if (dev->disk == NULL || is_unencrypted_disk (dev->disk) == true)
 	{
 	  grub_device_close (dev);
 	  grub_errno = GRUB_ERR_NONE;
-- 
2.11.0


_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

[SECURITY PATCH 5/8] docs: Document available crypto disks checks

[Daniel Kiper via Grub-devel]

From: Maxim Suhanov <dfirblog@gmail.com>

Document the --cryptodisk-only argument. Also, document the
"cryptocheck" command invoked when that argument is processed.

Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
 docs/grub.texi | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/docs/grub.texi b/docs/grub.texi
index 2b3d536d3..48438c2b6 100644
--- a/docs/grub.texi
+++ b/docs/grub.texi
@@ -4475,6 +4475,8 @@ This module provides library support for writing to a storage disk.
 @node diskfilter_module
 @section diskfilter
 This module provides library support for reading a disk RAID array.
+It also provides support for the command @command{cryptocheck}.
+@xref{cryptocheck} for more information.
 
 @node div_module
 @section div
@@ -6427,6 +6429,7 @@ you forget a command, you can run the command @command{help}
 * configfile::                  Load a configuration file
 * cpuid::                       Check for CPU features
 * crc::                         Compute or check CRC32 checksums
+* cryptocheck::                 Check if a device is encrypted
 * cryptomount::                 Mount a crypto device
 * cutmem::                      Remove memory regions
 * date::                        Display or set current date and time
@@ -6737,6 +6740,16 @@ Alias for @code{hashsum --hash crc32 arg @dots{}}. See command @command{hashsum}
 (@pxref{hashsum}) for full description.
 @end deffn
 
+@node cryptocheck
+@subsection cryptocheck
+
+@deffn Command cryptocheck device
+Check if a given diskfilter device is backed by encrypted devices
+(@pxref{cryptomount} for additional information).
+
+The command examines all backing devices, physical volumes, of a specified
+logical volume, like LVM2, and fails when at least one of them is unencrypted.
+@end deffn
 
 @node cryptomount
 @subsection cryptomount
@@ -7666,7 +7679,8 @@ unbootable. @xref{Using digital signatures}, for more information.
 
 @deffn Command search @
  [@option{--file}|@option{--label}|@option{--fs-uuid}] @
- [@option{--set} [var]] [@option{--no-floppy}|@option{--efidisk-only}] name
+ [@option{--set} [var]] [@option{--no-floppy}|@option{--efidisk-only}|@option{--cryptodisk-only}] @
+ name
 Search devices by file (@option{-f}, @option{--file}), filesystem label
 (@option{-l}, @option{--label}), or filesystem UUID (@option{-u},
 @option{--fs-uuid}).
@@ -7681,6 +7695,14 @@ devices, which can be slow.
 The (@option{--efidisk-only}) option prevents searching any other devices then
 EFI disks. This is typically used when chainloading to local EFI partition.
 
+The (@option{--cryptodisk-only}) option prevents searching any devices other
+than encrypted disks. This is typically used when booting from an encrypted
+file system to ensure that no code gets executed from an unencrypted device
+having the same filesystem UUID or label.
+
+This option implicitly invokes the command @command{cryptocheck}, if it is
+available (@pxref{cryptocheck} for additional information).
+
 The @samp{search.file}, @samp{search.fs_label}, and @samp{search.fs_uuid}
 commands are aliases for @samp{search --file}, @samp{search --label}, and
 @samp{search --fs-uuid} respectively.
-- 
2.11.0


_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

[SECURITY PATCH 6/8] disk/cryptodisk: Add the "erase secrets" function

[Daniel Kiper via Grub-devel]

From: Maxim Suhanov <dfirblog@gmail.com>

This commit adds the grub_cryptodisk_erasesecrets() function to wipe
master keys from all cryptodisks. This function is EFI-only.

Since there is no easy way to "force unmount" a given encrypted disk,
this function renders all mounted cryptodisks unusable. An attempt to
read them will return garbage.

This is why this function must be used in "no way back" conditions.

Currently, it is used when unloading the cryptodisk module and when
performing the "exit" command (it is often used to switch to the next
EFI application). This function is not called when performing the
"chainloader" command, because the callee may return to GRUB. For this
reason, users are encouraged to use "exit" instead of "chainloader" to
execute third-party boot applications.

This function does not guarantee that all secrets are wiped from RAM.
Console output, chunks from disk read requests and other may remain.

This function does not clear the IV prefix and rekey key for geli disks.

Also, this commit adds the relevant documentation improvements.

Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
 docs/grub.texi               |  6 ++++++
 grub-core/commands/minicmd.c | 11 +++++++++++
 grub-core/disk/cryptodisk.c  | 28 ++++++++++++++++++++++++++++
 include/grub/cryptodisk.h    |  1 +
 4 files changed, 46 insertions(+)

diff --git a/docs/grub.texi b/docs/grub.texi
index 48438c2b6..cc4acb27e 100644
--- a/docs/grub.texi
+++ b/docs/grub.texi
@@ -6788,6 +6788,11 @@ namespace in addition to the cryptodisk namespace.
 
 Support for plain encryption mode (plain dm-crypt) is provided via separate
 @command{@pxref{plainmount}} command.
+
+On the EFI platform, GRUB tries to erase master keys from memory when the cryptodisk
+module is unloaded or the command @command{exit} is executed. All secrets remain in
+memory when the command @command{chainloader} is issued, because execution can
+return to GRUB on the EFI platform.
 @end deffn
 
 @node cutmem
@@ -9406,6 +9411,7 @@ USB support provides benefits similar to ATA (for USB disks) or AT (for USB
 keyboards). In addition it allows USBserial.
 
 Chainloading refers to the ability to load another bootloader through the same protocol
+and on some platforms, like EFI, allow that bootloader to return to the GRUB.
 
 Hints allow faster disk discovery by already knowing in advance which is the disk in
 question. On some platforms hints are correct unless you move the disk between boots.
diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c
index 8c5ee3e60..ff4ff021c 100644
--- a/grub-core/commands/minicmd.c
+++ b/grub-core/commands/minicmd.c
@@ -29,6 +29,10 @@
 #include <grub/command.h>
 #include <grub/i18n.h>
 
+#ifdef GRUB_MACHINE_EFI
+#include <grub/cryptodisk.h>
+#endif
+
 GRUB_MOD_LICENSE ("GPLv3+");
 
 /* cat FILE */
@@ -187,6 +191,13 @@ grub_mini_cmd_exit (struct grub_command *cmd __attribute__ ((unused)),
 		    int argc __attribute__ ((unused)),
 		    char *argv[] __attribute__ ((unused)))
 {
+#ifdef GRUB_MACHINE_EFI
+  /*
+   * The "exit" command is often used to launch the next boot application.
+   * So, erase the secrets.
+   */
+  grub_cryptodisk_erasesecrets ();
+#endif
   grub_exit ();
   /* Not reached.  */
 }
diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
index 7a785a49c..544a30d61 100644
--- a/grub-core/disk/cryptodisk.c
+++ b/grub-core/disk/cryptodisk.c
@@ -1856,6 +1856,31 @@ grub_cryptodisk_challenge_password (void)
 
   return GRUB_ERR_NONE;
 }
+
+void
+grub_cryptodisk_erasesecrets (void)
+{
+  grub_cryptodisk_t i;
+  grub_uint8_t *buf;
+
+  buf = grub_zalloc (GRUB_CRYPTODISK_MAX_KEYLEN);
+  if (buf == NULL)
+    grub_fatal ("grub_cryptodisk_erasesecrets: cannot allocate memory");
+
+  for (i = cryptodisk_list; i != NULL; i = i->next)
+    if (grub_cryptodisk_setkey (i, buf, i->keysize))
+      grub_fatal ("grub_cryptodisk_erasesecrets: cannot erase secrets for %s", i->source);
+    else
+      grub_printf ("Erased crypto secrets for %s\n", i->source);
+      /*
+       * Unfortunately, there is no way to "force unmount" a given disk, it may
+       * have mounted "child" disks as well, e.g., an LVM volume. So, this
+       * function MUST be called when there is no way back, e.g., when exiting.
+       * Otherwise, subsequent read calls for a cryptodisk will return garbage.
+       */
+
+  grub_free (buf);
+}
 #endif /* GRUB_MACHINE_EFI */
 
 struct grub_procfs_entry luks_script =
@@ -1880,6 +1905,9 @@ GRUB_MOD_INIT (cryptodisk)
 
 GRUB_MOD_FINI (cryptodisk)
 {
+#ifdef GRUB_MACHINE_EFI
+  grub_cryptodisk_erasesecrets ();
+#endif
   grub_disk_dev_unregister (&grub_cryptodisk_dev);
   cryptodisk_cleanup ();
   grub_unregister_extcmd (cmd);
diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h
index 5bb15751d..81e631778 100644
--- a/include/grub/cryptodisk.h
+++ b/include/grub/cryptodisk.h
@@ -205,5 +205,6 @@ grub_cryptodisk_t grub_cryptodisk_get_by_source_disk (grub_disk_t disk);
 
 #ifdef GRUB_MACHINE_EFI
 grub_err_t grub_cryptodisk_challenge_password (void);
+void grub_cryptodisk_erasesecrets (void);
 #endif
 #endif
-- 
2.11.0


_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

[SECURITY PATCH 7/8] disk/cryptodisk: Wipe the passphrase from memory

[Daniel Kiper via Grub-devel]

From: Maxim Suhanov <dfirblog@gmail.com>

Switching to another EFI boot application while there are secrets in
RAM is dangerous, because not all firmware is wiping memory on free.

To reduce the attack surface, wipe the passphrase acquired when
unlocking an encrypted volume.

Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
 grub-core/disk/cryptodisk.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
index 544a30d61..7065bcdcb 100644
--- a/grub-core/disk/cryptodisk.c
+++ b/grub-core/disk/cryptodisk.c
@@ -1302,6 +1302,7 @@ grub_cryptodisk_scan_device_real (const char *name,
 
   if (askpass)
     {
+      grub_memset (cargs->key_data, 0, cargs->key_len);
       cargs->key_len = 0;
       grub_free (cargs->key_data);
     }
-- 
2.11.0


_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

[SECURITY PATCH 8/8] cryptocheck: Add --quiet option

[Daniel Kiper via Grub-devel]

From: Michael Chang <mchang@suse.com>

The option can be used to suppress output if we only want to test the
return value of the command.

Also, mention this option in the documentation.

Signed-off-by: Michael Chang <mchang@suse.com>
Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
 docs/grub.texi              |  4 +++-
 grub-core/commands/search.c |  7 ++++++-
 grub-core/disk/diskfilter.c | 25 +++++++++++++++++++------
 3 files changed, 28 insertions(+), 8 deletions(-)

diff --git a/docs/grub.texi b/docs/grub.texi
index cc4acb27e..34b3484dc 100644
--- a/docs/grub.texi
+++ b/docs/grub.texi
@@ -6743,12 +6743,14 @@ Alias for @code{hashsum --hash crc32 arg @dots{}}. See command @command{hashsum}
 @node cryptocheck
 @subsection cryptocheck
 
-@deffn Command cryptocheck device
+@deffn Command cryptocheck [ @option{--quiet} ] device
 Check if a given diskfilter device is backed by encrypted devices
 (@pxref{cryptomount} for additional information).
 
 The command examines all backing devices, physical volumes, of a specified
 logical volume, like LVM2, and fails when at least one of them is unencrypted.
+
+The option @option{--quiet} can be given to suppress the output.
 @end deffn
 
 @node cryptomount
diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c
index 185c1e70f..49b679e80 100644
--- a/grub-core/commands/search.c
+++ b/grub-core/commands/search.c
@@ -67,6 +67,9 @@ is_unencrypted_disk (grub_disk_t disk)
 
   if (disk->dev->id == GRUB_DISK_DEVICE_DISKFILTER_ID)
     {
+      char opt[] = "--quiet";
+      char *args[2];
+
       cmd = grub_command_find ("cryptocheck");
       if (cmd == NULL) /* No diskfilter module loaded for some reason. */
         return true;
@@ -77,7 +80,9 @@ is_unencrypted_disk (grub_disk_t disk)
         return true;
 
       grub_snprintf (disk_str, disk_str_len, "(%s)", disk->name);
-      res = cmd->func (cmd, 1, &disk_str);
+      args[0] = opt;
+      args[1] = disk_str;
+      res = cmd->func (cmd, 2, args);
       grub_free (disk_str);
       return (res != GRUB_ERR_NONE) ? true : false; /* GRUB_ERR_NONE for encrypted. */
     }
diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c
index 9eda22e3f..3a26de60c 100644
--- a/grub-core/disk/diskfilter.c
+++ b/grub-core/disk/diskfilter.c
@@ -1414,6 +1414,19 @@ grub_cmd_cryptocheck (grub_command_t cmd __attribute__ ((unused)),
   int check_pvs_res;
   int namelen;
   int pvs_cnt;
+  int opt_quiet = 0;
+
+  if (argc == 2)
+    {
+      if (grub_strcmp (args[0], "--quiet") == 0)
+	{
+	  opt_quiet = 1;
+	  argc--;
+	  args++;
+	}
+      else
+	return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("unrecognized option: %s"), args[0]);
+    }
 
   if (argc != 1)
     return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("disk name expected"));
@@ -1436,11 +1449,11 @@ grub_cmd_cryptocheck (grub_command_t cmd __attribute__ ((unused)),
 
   check_pvs_res = grub_diskfilter_check_pvs_encrypted (disk, &pvs_cnt);
   grub_disk_close (disk);
-
-  grub_printf("%s is %sencrypted (%d pv%s examined)\n", &args[0][1],
-              (check_pvs_res == GRUB_ERR_NONE) ? "" : "un",
-              pvs_cnt,
-              (pvs_cnt > 1) ? "s" : "");
+  if (!opt_quiet)
+    grub_printf ("%s is %sencrypted (%d pv%s examined)\n", &args[0][1],
+		 (check_pvs_res == GRUB_ERR_NONE) ? "" : "un",
+		 pvs_cnt,
+		 (pvs_cnt > 1) ? "s" : "");
 
   return check_pvs_res;
 }
@@ -1468,7 +1481,7 @@ GRUB_MOD_INIT(diskfilter)
 {
   grub_disk_dev_register (&grub_diskfilter_dev);
   cmd = grub_register_command ("cryptocheck", grub_cmd_cryptocheck,
-                                N_("DEVICE"),
+                                N_("[--quiet] DEVICE"),
                                 N_("Check if a logical volume resides on encrypted disks."));
 }
 
-- 
2.11.0


_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

Re: [SECURITY PATCH 00/08] GRUB2 vulnerabilities - 2025/05/08

[Christian Hesse]

[-- Attachment #1.1: Type: text/plain, Size: 405 bytes --]

Daniel Kiper <daniel.kiper@oracle.com> on Thu, 2025/05/08 19:02:
> [...] Now all the GRUB2 upstream patches are in
> the GRUB2 git repository [2] too.
>
> [...]
> 
> [2] https://git.savannah.gnu.org/gitweb/?p=grub.git
>     https://git.savannah.gnu.org/git/grub.git

Does not look like... The last commit is still
4abac0ad5a7914dd3cdfff08aaac06588bf98d80 from April.
-- 
Best regards,
Chris

[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

[-- Attachment #2: Type: text/plain, Size: 141 bytes --]

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

Re: [SECURITY PATCH 00/08] GRUB2 vulnerabilities - 2025/05/08

[Daniel Kiper via Grub-devel]

On Fri, May 09, 2025 at 09:47:05AM +0200, Christian Hesse wrote:
> Daniel Kiper <daniel.kiper@oracle.com> on Thu, 2025/05/08 19:02:
> > [...] Now all the GRUB2 upstream patches are in
> > the GRUB2 git repository [2] too.
> >
> > [...]
> >
> > [2] https://git.savannah.gnu.org/gitweb/?p=grub.git
> >     https://git.savannah.gnu.org/git/grub.git
>
> Does not look like... The last commit is still
> 4abac0ad5a7914dd3cdfff08aaac06588bf98d80 from April.

Now they are in... Savannah has some hiccups recently...

Daniel

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

Re: [SECURITY PATCH 8/8] cryptocheck: Add --quiet option

[Vladimir 'phcoder' Serbinenko]

[-- Attachment #1.1: Type: text/plain, Size: 2309 bytes --]

Can we use extcmd for this?


>
>
>    if (disk->dev->id == GRUB_DISK_DEVICE_DISKFILTER_ID)
>      {
> +      char opt[] = "--quiet";
> +      char *args[2];
> +
>        cmd = grub_command_find ("cryptocheck");
>        if (cmd == NULL) /* No diskfilter module loaded for some reason. */
>          return true;
> @@ -77,7 +80,9 @@ is_unencrypted_disk (grub_disk_t disk)
>          return true;
>
>        grub_snprintf (disk_str, disk_str_len, "(%s)", disk->name);
> -      res = cmd->func (cmd, 1, &disk_str);
> +      args[0] = opt;
> +      args[1] = disk_str;
> +      res = cmd->func (cmd, 2, args);
>        grub_free (disk_str);
>        return (res != GRUB_ERR_NONE) ? true : false; /* GRUB_ERR_NONE for
> encrypted. */
>      }
> diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c
> index 9eda22e3f..3a26de60c 100644
> --- a/grub-core/disk/diskfilter.c
> +++ b/grub-core/disk/diskfilter.c
> @@ -1414,6 +1414,19 @@ grub_cmd_cryptocheck (grub_command_t cmd
> __attribute__ ((unused)),
>    int check_pvs_res;
>    int namelen;
>    int pvs_cnt;
> +  int opt_quiet = 0;
> +
> +  if (argc == 2)
>
This needs extcmd for both consistency and better documentation.

> +    {
> +      if (grub_strcmp (args[0], "--quiet") == 0)
> +       {
> +         opt_quiet = 1;
> +         argc--;
> +         args++;
> +       }
> +      else
> +       return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("unrecognized option:
> %s"), args[0]);
> +    }
>
>    if (argc != 1)
>      return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("disk name expected"));
> @@ -1436,11 +1449,11 @@ grub_cmd_cryptocheck (grub_command_t cmd
> __attribute__ ((unused)),
>
>    check_pvs_res = grub_diskfilter_check_pvs_encrypted (disk, &pvs_cnt);
>    grub_disk_close (disk);
> -
> -  grub_printf("%s is %sencrypted (%d pv%s examined)\n", &args[0][1],
>
Please make this properly translatable. Use full sentences, ngettext and
avoid string arithmetic.

> -              (check_pvs_res == GRUB_ERR_NONE) ? "" : "un",
> -              pvs_cnt,
> -              (pvs_cnt > 1) ? "s" : "");
> +  if (!opt_quiet)
> +    grub_printf ("%s is %sencrypted (%d pv%s examined)\n", &args[0][1],
> +                (check_pvs_res == GRUB_ERR_NONE) ? "" : "un",
> +                pvs_cnt,
> +                (pvs_cnt > 1) ? "s" : "");
>

>

[-- Attachment #1.2: Type: text/html, Size: 3641 bytes --]

[-- Attachment #2: Type: text/plain, Size: 141 bytes --]

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

Re: [SECURITY PATCH 7/8] disk/cryptodisk: Wipe the passphrase from memory

[Vladimir 'phcoder' Serbinenko]

[-- Attachment #1.1: Type: text/plain, Size: 1287 bytes --]

Reviewed-by: Vladimir Serbinenko phcoder@gmail.com

Regards
Vladimir 'phcoder' Serbinenko

Le jeu. 8 mai 2025, 20:04, Daniel Kiper via Grub-devel <grub-devel@gnu.org>
a écrit :

> From: Maxim Suhanov <dfirblog@gmail.com>
>
> Switching to another EFI boot application while there are secrets in
> RAM is dangerous, because not all firmware is wiping memory on free.
>
> To reduce the attack surface, wipe the passphrase acquired when
> unlocking an encrypted volume.
>
> Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
> ---
>  grub-core/disk/cryptodisk.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
> index 544a30d61..7065bcdcb 100644
> --- a/grub-core/disk/cryptodisk.c
> +++ b/grub-core/disk/cryptodisk.c
> @@ -1302,6 +1302,7 @@ grub_cryptodisk_scan_device_real (const char *name,
>
>    if (askpass)
>      {
> +      grub_memset (cargs->key_data, 0, cargs->key_len);
>        cargs->key_len = 0;
>        grub_free (cargs->key_data);
>      }
> --
> 2.11.0
>
>
> _______________________________________________
> Grub-devel mailing list
> Grub-devel@gnu.org
> https://lists.gnu.org/mailman/listinfo/grub-devel
>

[-- Attachment #1.2: Type: text/html, Size: 2213 bytes --]

[-- Attachment #2: Type: text/plain, Size: 141 bytes --]

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

Re: [SECURITY PATCH 6/8] disk/cryptodisk: Add the "erase secrets" function

[Vladimir 'phcoder' Serbinenko]

[-- Attachment #1.1: Type: text/plain, Size: 6056 bytes --]

Le jeu. 8 mai 2025, 20:04, Daniel Kiper via Grub-devel <grub-devel@gnu.org>
a écrit :

> From: Maxim Suhanov <dfirblog@gmail.com>
>
> This commit adds the grub_cryptodisk_erasesecrets() function to wipe
> master keys from all cryptodisks. This function is EFI-only.
>
> Since there is no easy way to "force unmount" a given encrypted disk,
> this function renders all mounted cryptodisks unusable. An attempt to
> read them will return garbage.
>
That is wrong. We need to unmount it and any further attempt to read from
given disk should return "no such disk".

>
> This is why this function must be used in "no way back" conditions.
>
> Currently, it is used when unloading the cryptodisk module and when
> performing the "exit" command (it is often used to switch to the next
> EFI application). This function is not called when performing the
> "chainloader" command, because the callee may return to GRUB. For this
> reason, users are encouraged to use "exit" instead of "chainloader" to
> execute third-party boot applications.
>
> This function does not guarantee that all secrets are wiped from RAM.
> Console output, chunks from disk read requests and other may remain.
>
> This function does not clear the IV prefix and rekey key for geli disks.
>
> Also, this commit adds the relevant documentation improvements.
>
> Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
> ---
>  docs/grub.texi               |  6 ++++++
>  grub-core/commands/minicmd.c | 11 +++++++++++
>  grub-core/disk/cryptodisk.c  | 28 ++++++++++++++++++++++++++++
>  include/grub/cryptodisk.h    |  1 +
>  4 files changed, 46 insertions(+)
>
> diff --git a/docs/grub.texi b/docs/grub.texi
> index 48438c2b6..cc4acb27e 100644
> --- a/docs/grub.texi
> +++ b/docs/grub.texi
> @@ -6788,6 +6788,11 @@ namespace in addition to the cryptodisk namespace.
>
>  Support for plain encryption mode (plain dm-crypt) is provided via
> separate
>  @command{@pxref{plainmount}} command.
> +
> +On the EFI platform, GRUB tries to erase master keys from memory when the
> cryptodisk
> +module is unloaded or the command @command{exit} is executed. All secrets
> remain in
> +memory when the command @command{chainloader} is issued, because
> execution can
> +return to GRUB on the EFI platform.
>  @end deffn
>
>  @node cutmem
> @@ -9406,6 +9411,7 @@ USB support provides benefits similar to ATA (for
> USB disks) or AT (for USB
>  keyboards). In addition it allows USBserial.
>
>  Chainloading refers to the ability to load another bootloader through the
> same protocol
> +and on some platforms, like EFI, allow that bootloader to return to the
> GRUB.
>
>  Hints allow faster disk discovery by already knowing in advance which is
> the disk in
>  question. On some platforms hints are correct unless you move the disk
> between boots.
> diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c
> index 8c5ee3e60..ff4ff021c 100644
> --- a/grub-core/commands/minicmd.c
> +++ b/grub-core/commands/minicmd.c
> @@ -29,6 +29,10 @@
>  #include <grub/command.h>
>  #include <grub/i18n.h>
>
> +#ifdef GRUB_MACHINE_EFI
> +#include <grub/cryptodisk.h>
> +#endif
> +
>  GRUB_MOD_LICENSE ("GPLv3+");
>
>  /* cat FILE */
> @@ -187,6 +191,13 @@ grub_mini_cmd_exit (struct grub_command *cmd
> __attribute__ ((unused)),
>                     int argc __attribute__ ((unused)),
>                     char *argv[] __attribute__ ((unused)))
>  {
> +#ifdef GRUB_MACHINE_EFI
> +  /*
> +   * The "exit" command is often used to launch the next boot application.
> +   * So, erase the secrets.
> +   */
> +  grub_cryptodisk_erasesecrets ();
> +#endif
>    grub_exit ();
>    /* Not reached.  */
>  }
> diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
> index 7a785a49c..544a30d61 100644
> --- a/grub-core/disk/cryptodisk.c
> +++ b/grub-core/disk/cryptodisk.c
> @@ -1856,6 +1856,31 @@ grub_cryptodisk_challenge_password (void)
>
>    return GRUB_ERR_NONE;
>  }
> +
> +void
> +grub_cryptodisk_erasesecrets (void)
> +{
> +  grub_cryptodisk_t i;
> +  grub_uint8_t *buf;
> +
> +  buf = grub_zalloc (GRUB_CRYPTODISK_MAX_KEYLEN);
> +  if (buf == NULL)
> +    grub_fatal ("grub_cryptodisk_erasesecrets: cannot allocate memory");
> +
> +  for (i = cryptodisk_list; i != NULL; i = i->next)
> +    if (grub_cryptodisk_setkey (i, buf, i->keysize))
> +      grub_fatal ("grub_cryptodisk_erasesecrets: cannot erase secrets for
> %s", i->source);
> +    else
> +      grub_printf ("Erased crypto secrets for %s\n", i->source);
> +      /*
> +       * Unfortunately, there is no way to "force unmount" a given disk,
> it may
> +       * have mounted "child" disks as well, e.g., an LVM volume. So, this
> +       * function MUST be called when there is no way back, e.g., when
> exiting.
> +       * Otherwise, subsequent read calls for a cryptodisk will return
> garbage.
> +       */
> +
> +  grub_free (buf);
> +}
>  #endif /* GRUB_MACHINE_EFI */
>
>  struct grub_procfs_entry luks_script =
> @@ -1880,6 +1905,9 @@ GRUB_MOD_INIT (cryptodisk)
>
>  GRUB_MOD_FINI (cryptodisk)
>  {
> +#ifdef GRUB_MACHINE_EFI
> +  grub_cryptodisk_erasesecrets ();
> +#endif
>    grub_disk_dev_unregister (&grub_cryptodisk_dev);
>    cryptodisk_cleanup ();
>    grub_unregister_extcmd (cmd);
> diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h
> index 5bb15751d..81e631778 100644
> --- a/include/grub/cryptodisk.h
> +++ b/include/grub/cryptodisk.h
> @@ -205,5 +205,6 @@ grub_cryptodisk_t grub_cryptodisk_get_by_source_disk
> (grub_disk_t disk);
>
>  #ifdef GRUB_MACHINE_EFI
>  grub_err_t grub_cryptodisk_challenge_password (void);
> +void grub_cryptodisk_erasesecrets (void);
>  #endif
>  #endif
> --
> 2.11.0
>
>
> _______________________________________________
> Grub-devel mailing list
> Grub-devel@gnu.org
> https://lists.gnu.org/mailman/listinfo/grub-devel
>

[-- Attachment #1.2: Type: text/html, Size: 7563 bytes --]

[-- Attachment #2: Type: text/plain, Size: 141 bytes --]

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

Re: [SECURITY PATCH 4/8] commands/search: Add the diskfilter support

[Vladimir 'phcoder' Serbinenko]

[-- Attachment #1.1: Type: text/plain, Size: 2738 bytes --]

Le jeu. 8 mai 2025, 20:04, Daniel Kiper via Grub-devel <grub-devel@gnu.org>
a écrit :

> From: Maxim Suhanov <dfirblog@gmail.com>
>
> When the --cryptodisk-only argument is given, also check the target
> device using the "cryptocheck" command, if available.
>
> This extends the checks to common layouts like LVM-on-LUKS, so the
> --cryptodisk-only argument transparently handles such setups.
>
> Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
> ---
>  grub-core/commands/search.c | 32 +++++++++++++++++++++++++++++++-
>  1 file changed, 31 insertions(+), 1 deletion(-)
>
> diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c
> index f6bfef958..185c1e70f 100644
> --- a/grub-core/commands/search.c
> +++ b/grub-core/commands/search.c
> @@ -54,6 +54,36 @@ struct search_ctx
>    int is_cache;
>  };
>
> +static bool
> +is_unencrypted_disk (grub_disk_t disk)
> +{
> +  grub_command_t cmd;
> +  char *disk_str;
> +  int disk_str_len;
> +  int res;
> +
> +  if (disk->dev->id == GRUB_DISK_DEVICE_CRYPTODISK_ID)
> +    return false; /* This is (crypto) disk. */
> +
> +  if (disk->dev->id == GRUB_DISK_DEVICE_DISKFILTER_ID)
> +    {
> +      cmd = grub_command_find ("cryptocheck");
>
I would prefer not to go through command parser but instead define a
function for crypto check.

+        return true;
> +
> +      disk_str_len = grub_strlen (disk->name) + 2 + 1;
> +      disk_str = grub_malloc (disk_str_len);
> +      if (disk_str == NULL) /* Something is wrong, better report as
> unencrypted. */
>
You need to properly handle the error. Either reset grub_errno or to return
an error to upper layer (preferred).

> +        return true;
> +
> +      grub_snprintf (disk_str, disk_str_len, "(%s)", disk->name);
> +      res = cmd->func (cmd, 1, &disk_str);
> +      grub_free (disk_str);
> +      return (res != GRUB_ERR_NONE) ? true : false; /* GRUB_ERR_NONE for
> encrypted. */
> +    }
> +  return true;
> +}
> +
>  /* Helper for FUNC_NAME.  */
>  static int
>  iterate_device (const char *name, void *data)
> @@ -97,7 +127,7 @@ iterate_device (const char *name, void *data)
>           grub_errno = GRUB_ERR_NONE;
>           return 0;
>         }
> -      if (dev->disk == NULL || dev->disk->dev->id !=
> GRUB_DISK_DEVICE_CRYPTODISK_ID)
> +      if (dev->disk == NULL || is_unencrypted_disk (dev->disk) == true)
>         {
>           grub_device_close (dev);
>           grub_errno = GRUB_ERR_NONE;
> --
> 2.11.0
>
>
> _______________________________________________
> Grub-devel mailing list
> Grub-devel@gnu.org
> https://lists.gnu.org/mailman/listinfo/grub-devel
>

[-- Attachment #1.2: Type: text/html, Size: 4198 bytes --]

[-- Attachment #2: Type: text/plain, Size: 141 bytes --]

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

Re: [SECURITY PATCH 3/8] disk/diskfilter: Introduce the "cryptocheck" command

[Vladimir 'phcoder' Serbinenko]

[-- Attachment #1.1: Type: text/plain, Size: 4727 bytes --]

Le jeu. 8 mai 2025, 20:04, Daniel Kiper via Grub-devel <grub-devel@gnu.org>
a écrit :

> From: Maxim Suhanov <dfirblog@gmail.com>
>
> This command examines a given diskfilter device, e.g., an LVM disk,
> and checks if underlying disks, physical volumes, are cryptodisks,
> e.g., LUKS disks, this layout is called "LVM-on-LUKS".
>
> The return value is 0 when all underlying disks (of a given device)
> are cryptodisks (1 if at least one disk is unencrypted or in an
> unknown state).
>
> Users are encouraged to include the relevant check before loading
> anything from an LVM disk that is supposed to be encrypted.
>
> This further supports the CLI authentication, blocking bypass
> attempts when booting from an encrypted LVM disk.
>
> Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
> ---
>  grub-core/disk/diskfilter.c | 75
> +++++++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 75 insertions(+)
>
> diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c
> index cc5062691..9eda22e3f 100644
> --- a/grub-core/disk/diskfilter.c
> +++ b/grub-core/disk/diskfilter.c
> @@ -20,6 +20,7 @@
>  #include <grub/dl.h>
>  #include <grub/disk.h>
>  #include <grub/mm.h>
> +#include <grub/command.h>
>  #include <grub/err.h>
>  #include <grub/misc.h>
>  #include <grub/diskfilter.h>
> @@ -1377,6 +1378,73 @@ grub_diskfilter_get_pv_from_disk (grub_disk_t disk,
>  }
>  #endif
>
> +static int
>
Please use bool if you want to return boolean or grub_err_t if you return
error codes. Int is undescriptive.

> +grub_diskfilter_check_pvs_encrypted (grub_disk_t disk, int *pvs_cnt)
> +{
> +  struct grub_diskfilter_lv *lv = disk->data;
> +  struct grub_diskfilter_pv *pv;
> +
> +  *pvs_cnt = 0;
> +
> +  if (lv->vg->pvs)
> +    for (pv = lv->vg->pvs; pv; pv = pv->next)
> +      {
> +        (*pvs_cnt)++;
> +
> +        if (pv->disk == NULL)
> +          {
> +            /* Can be a partially activated VG, bail out. */
> +            return GRUB_ERR_TEST_FAILURE;
> +          }
> +
> +        if (pv->disk->dev->id != GRUB_DISK_DEVICE_CRYPTODISK_ID)
> +          {
> +            /* All backing devices must be cryptodisks, stop. */
> +            return GRUB_ERR_TEST_FAILURE;
> +          }
> +      }
> +  return GRUB_ERR_NONE;
> +}
> +
> +static grub_err_t
> +grub_cmd_cryptocheck (grub_command_t cmd __attribute__ ((unused)),
> +               int argc, char **args)
> +{
> +  grub_disk_t disk;
> +  int check_pvs_res;
> +  int namelen;
> +  int pvs_cnt;
> +
> +  if (argc != 1)
> +    return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("disk name expected"));
> +
> +  namelen = grub_strlen (args[0]);
> +  if (namelen > 2 && (args[0][0] == '(') && (args[0][namelen - 1] == ')'))
> +    args[0][namelen - 1] = 0;
> +  else
> +    return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("invalid disk: %s"),
> +                       args[0]);
> +
> +  if (!is_valid_diskfilter_name (&args[0][1]))
> +    return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("unrecognized disk:
> %s"),
> +                       &args[0][1]);
> +
> +  disk = grub_disk_open (&args[0][1]);
> +  if (disk == NULL)
> +    return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("no such disk: %s"),
> +                       &args[0][1]);
> +
> +  check_pvs_res = grub_diskfilter_check_pvs_encrypted (disk, &pvs_cnt);
> +  grub_disk_close (disk);
> +
> +  grub_printf("%s is %sencrypted (%d pv%s examined)\n", &args[0][1],
> +              (check_pvs_res == GRUB_ERR_NONE) ? "" : "un",
> +              pvs_cnt,
> +              (pvs_cnt > 1) ? "s" : "");
>
Please make this translatable

> +
> +  return check_pvs_res;
>
Please set grub_errno properly

> +}
> +
>  static struct grub_disk_dev grub_diskfilter_dev =
>    {
>      .name = "diskfilter",
> @@ -1393,14 +1461,21 @@ static struct grub_disk_dev grub_diskfilter_dev =
>      .next = 0
>    };
>
> +static grub_command_t cmd;
> +
>
>  GRUB_MOD_INIT(diskfilter)
>  {
>    grub_disk_dev_register (&grub_diskfilter_dev);
> +  cmd = grub_register_command ("cryptocheck", grub_cmd_cryptocheck,
> +                                N_("DEVICE"),
> +                                N_("Check if a logical volume resides on
> encrypted disks."));
>  }
>
>  GRUB_MOD_FINI(diskfilter)
>  {
>    grub_disk_dev_unregister (&grub_diskfilter_dev);
> +  if (cmd != NULL)
> +    grub_unregister_command (cmd);
>    free_array ();
>  }
> --
> 2.11.0
>
>
> _______________________________________________
> Grub-devel mailing list
> Grub-devel@gnu.org
> https://lists.gnu.org/mailman/listinfo/grub-devel
>

[-- Attachment #1.2: Type: text/html, Size: 6859 bytes --]

[-- Attachment #2: Type: text/plain, Size: 141 bytes --]

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

Re: [SECURITY PATCH 2/8] commands/search: Introduce the --cryptodisk-only argument

[Vladimir 'phcoder' Serbinenko]

[-- Attachment #1.1: Type: text/plain, Size: 5553 bytes --]

Small nitpick, otherwise
Reviewed-by: Vladimir Serbinenko phcoder@gmail.com

Le jeu. 8 mai 2025, 20:03, Daniel Kiper via Grub-devel <grub-devel@gnu.org>
a écrit :

> From: Maxim Suhanov <dfirblog@gmail.com>
>
> This allows users to restrict the "search" command's scope to
> encrypted disks only.
>
> Typically, this command is used to "rebase" $root and $prefix
> before loading additional configuration files via "source" or
> "configfile". Unfortunately, this leads to security problems,
> like CVE-2023-4001, when an unexpected, attacker-controlled
> device is chosen by the "search" command.
>
> The --cryptodisk-only argument allows users to ensure that the
> file system picked is encrypted.
>
> This feature supports the CLI authentication, blocking bypass
> attempts.
>
> Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
> ---
>  grub-core/commands/search.c      | 20 ++++++++++++++++++++
>  grub-core/commands/search_wrap.c |  7 ++++++-
>  grub-core/normal/main.c          |  3 ++-
>  include/grub/search.h            |  7 ++++---
>  4 files changed, 32 insertions(+), 5 deletions(-)
>
> diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c
> index 263f1501c..f6bfef958 100644
> --- a/grub-core/commands/search.c
> +++ b/grub-core/commands/search.c
> @@ -86,6 +86,26 @@ iterate_device (const char *name, void *data)
>        grub_device_close (dev);
>      }
>
> +  /* Limit to encrypted disks when requested. */
> +  if (ctx->flags & SEARCH_FLAGS_CRYPTODISK_ONLY)
> +    {
> +      grub_device_t dev;
> +
> +      dev = grub_device_open (name);
> +      if (dev == NULL)
> +       {
> +         grub_errno = GRUB_ERR_NONE;
> +         return 0;
> +       }
> +      if (dev->disk == NULL || dev->disk->dev->id !=
> GRUB_DISK_DEVICE_CRYPTODISK_ID)
> +       {
> +         grub_device_close (dev);
> +         grub_errno = GRUB_ERR_NONE;
>
I think this grub_errno setting is redundant as device_open succeeded

> +         return 0;
> +       }
> +      grub_device_close (dev);
> +    }
> +
>  #ifdef DO_SEARCH_FS_UUID
>  #define compare_fn grub_strcasecmp
>  #else
> diff --git a/grub-core/commands/search_wrap.c
> b/grub-core/commands/search_wrap.c
> index 318581f3b..5f536006c 100644
> --- a/grub-core/commands/search_wrap.c
> +++ b/grub-core/commands/search_wrap.c
> @@ -41,6 +41,7 @@ static const struct grub_arg_option options[] =
>       ARG_TYPE_STRING},
>      {"no-floppy",      'n', 0, N_("Do not probe any floppy drive."), 0,
> 0},
>      {"efidisk-only",   0, 0, N_("Only probe EFI disks."), 0, 0},
> +    {"cryptodisk-only",        0, 0, N_("Only probe encrypted disks."),
> 0, 0},
>      {"hint",           'h', GRUB_ARG_OPTION_REPEATABLE,
>       N_("First try the device HINT. If HINT ends in comma, "
>         "also try subpartitions"), N_("HINT"), ARG_TYPE_STRING},
> @@ -75,6 +76,7 @@ enum options
>      SEARCH_SET,
>      SEARCH_NO_FLOPPY,
>      SEARCH_EFIDISK_ONLY,
> +    SEARCH_CRYPTODISK_ONLY,
>      SEARCH_HINT,
>      SEARCH_HINT_IEEE1275,
>      SEARCH_HINT_BIOS,
> @@ -189,6 +191,9 @@ grub_cmd_search (grub_extcmd_context_t ctxt, int argc,
> char **args)
>    if (state[SEARCH_EFIDISK_ONLY].set)
>      flags |= SEARCH_FLAGS_EFIDISK_ONLY;
>
> +  if (state[SEARCH_CRYPTODISK_ONLY].set)
> +    flags |= SEARCH_FLAGS_CRYPTODISK_ONLY;
> +
>    if (state[SEARCH_LABEL].set)
>      grub_search_label (id, var, flags, hints, nhints);
>    else if (state[SEARCH_FS_UUID].set)
> @@ -210,7 +215,7 @@ GRUB_MOD_INIT(search)
>    cmd =
>      grub_register_extcmd ("search", grub_cmd_search,
>                           GRUB_COMMAND_FLAG_EXTRACTOR |
> GRUB_COMMAND_ACCEPT_DASH,
> -                         N_("[-f|-l|-u|-s|-n] [--hint HINT [--hint HINT]
> ...]"
> +                         N_("[-f|-l|-u|-s|-n] [--cryptodisk-only] [--hint
> HINT [--hint HINT] ...]"
>                              " NAME"),
>                           N_("Search devices by file, filesystem label"
>                              " or filesystem UUID."
> diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
> index 04d058f55..96abfda2f 100644
> --- a/grub-core/normal/main.c
> +++ b/grub-core/normal/main.c
> @@ -511,7 +511,8 @@ static const char *features[] = {
>    "feature_chainloader_bpb", "feature_ntldr",
> "feature_platform_search_hint",
>    "feature_default_font_path", "feature_all_video_module",
>    "feature_menuentry_id", "feature_menuentry_options",
> "feature_200_final",
> -  "feature_nativedisk_cmd", "feature_timeout_style"
> +  "feature_nativedisk_cmd", "feature_timeout_style",
> +  "feature_search_cryptodisk_only"
>  };
>
>  GRUB_MOD_INIT(normal)
> diff --git a/include/grub/search.h b/include/grub/search.h
> index ffd2411ca..3eabaf0cc 100644
> --- a/include/grub/search.h
> +++ b/include/grub/search.h
> @@ -21,9 +21,10 @@
>
>  enum search_flags
>    {
> -    SEARCH_FLAGS_NONE          = 0,
> -    SEARCH_FLAGS_NO_FLOPPY     = 1,
> -    SEARCH_FLAGS_EFIDISK_ONLY  = 2
> +    SEARCH_FLAGS_NONE            = 0,
> +    SEARCH_FLAGS_NO_FLOPPY       = 1,
> +    SEARCH_FLAGS_EFIDISK_ONLY    = 2,
> +    SEARCH_FLAGS_CRYPTODISK_ONLY = 4
>    };
>
>  void grub_search_fs_file (const char *key, const char *var,
> --
> 2.11.0
>
>
> _______________________________________________
> Grub-devel mailing list
> Grub-devel@gnu.org
> https://lists.gnu.org/mailman/listinfo/grub-devel
>

[-- Attachment #1.2: Type: text/html, Size: 7478 bytes --]

[-- Attachment #2: Type: text/plain, Size: 141 bytes --]

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel