From: Steve McIntyre <steve@einval.com>
To: Bastien Roucaries <rouca@debian.org>, 1144079@bugs.debian.org
Cc: Carlos Henrique Lima Melara <charles@debian.org>,
Debian Security Team <team@security.debian.org>,
Gajendra Nath Soren <gajendranath025@gmail.com>,
grub-devel@gnu.org
Subject: Re: Bug#1144079: Mismerge of CVE-2025-13151
Date: Tue, 11 Aug 2026 17:26:45 +0100 [thread overview]
Message-ID: <20260811162645.GF1495695@tack.einval.com> (raw)
In-Reply-To: <1957669.R1toDxpfAE@debian-ei>
Adding the GRUB upstream development list on this too; the information
is already public in the Debian BTS so there's no point trying to keep
thie embargoed.
On Tue, Aug 11, 2026 at 10:20:10AM +0200, Bastien Roucaries wrote:
>Le mardi 11 août 2026, 06:19:06 heure d’été d’Europe centrale Carlos Henrique Lima Melara a écrit :
>> Control: found -1 2.14~git20250718.0e36779-1
>>
>> Hi,
>>
>> On Mon, Aug 10, 2026 at 09:50:59PM +0200, Bastien Roucaries wrote:
>> >
>> > CVE-2025-13151 (libtasn1 - off-by-one in asn1_expand_octet_string, fixed in
>> > 4.20.0)
>> >
>> > The fix changes:
>> > char name[2 * ASN1_MAX_NAME_SIZE + 1]
>> >
>> > to:
>> > char name[2 * ASN1_MAX_NAME_SIZE + 2]
>> >
>> > This applies to two functions: asn1_expand_any_defined_by and
>> > asn1_expand_octet_string.
>> >
>> > Grub2 vendor libtasn1 internally and show a partial fix -
>> > asn1_expand_any_defined_by has been updated (+ 2 present) but
>> > asn1_expand_octet_string still carries the vulnerable version (+ 1):
>> > - grub2 (grub-core/lib/libtasn1/lib/decoding.c)
>> > asn1_expand_any_defined_by: patched
>> > asn1_expand_octet_string: VULNERABLE
>> > Note: grub2 carries two separate embedded copies (libtasn1 and
>> > libtasn1-grub)
>> >
>> > Thanks to Gajendra Nath Soren
>>
>> This embedded copy was added in 9a26abbc368 (grub-2.14-rc1), so it only
>> (possibly) affects forky/sid.
>
>Can we report upstream ?
>
>rouca
>>
>> Cheers,
>> Charles
>>
>
--
Steve McIntyre, Cambridge, UK. steve@einval.com
Armed with "Valor": "Centurion" represents quality of Discipline,
Honor, Integrity and Loyalty. Now you don't have to be a Caesar to
concord the digital world while feeling safe and proud.
_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel
next parent reply other threads:[~2026-08-11 19:57 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <anqhaAq4ITWnZGRH@fw13.lan>
[not found] ` <2142111.0S5aU1g85B@debian-ei>
[not found] ` <1957669.R1toDxpfAE@debian-ei>
2026-08-11 16:26 ` Steve McIntyre [this message]
2026-08-11 20:55 ` Bug#1144079: Mismerge of CVE-2025-13151 Mike Gilbert
2026-08-11 21:12 ` Leo Sandoval via Grub-devel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260811162645.GF1495695@tack.einval.com \
--to=steve@einval.com \
--cc=1144079@bugs.debian.org \
--cc=charles@debian.org \
--cc=gajendranath025@gmail.com \
--cc=grub-devel@gnu.org \
--cc=rouca@debian.org \
--cc=team@security.debian.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.