[Buildroot] Grub security situation

From: Thomas Petazzoni via buildroot <buildroot@buildroot.org>
To: buildroot@buildroot.org
Cc: Thomas Perale <thomas.perale@mind.be>,
	Julien Olivain <ju.o@free.fr>,
	Romain Naour <romain.naour@smile.fr>
Subject: [Buildroot] Grub security situation
Date: Wed, 7 May 2025 23:19:02 +0200	[thread overview]
Message-ID: <20250507231902.14cbc9aa@windsurf> (raw)

Hello,

The latest pkg-stats scan reported to me a number of grub2 security
issues:

                         grub2 | CVE-2024-45778   | https://security-tracker.debian.org/tracker/CVE-2024-45778  
                         grub2 | CVE-2024-45782   | https://security-tracker.debian.org/tracker/CVE-2024-45782  
                         grub2 | CVE-2024-45779   | https://security-tracker.debian.org/tracker/CVE-2024-45779  
                         grub2 | CVE-2024-45780   | https://security-tracker.debian.org/tracker/CVE-2024-45780  
                         grub2 | CVE-2025-0678    | https://security-tracker.debian.org/tracker/CVE-2025-0678   

Looking at that in some details, there are in fact a LOT more CVEs:

  https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html

Many of them are not reported by pkg-stats because NVD has not
annotated those CVEs (meh).

Now when it becomes a bit tricky is that those CVEs are fixed by 73
patches. All of them have been applied upstream, but they are
apparently not trivial to backport on grub 2.12.

See Arch people complaining here:

  https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00124.html
  https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00098.html

There are currently 284 commits in grub's master on top of the 2.12
version we're using. Backporting the 73 patches fixing the security
issues seems complicated, and having all 284 commits as patches in
Buildroot also seems not very practical.

So the only solution that I can see right now is to used grub's master
branch (of course with a fixed commit). Of course, for 2025.02, this
means we would bump grub to a newer version that not only has security
fixes, but also a whole bunch of other random changes. But that's how
grub is maintained, and I'm not sure what we can do about it.

Opinions? Thoughts? Suggestions?

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot