oss-sec mailing list archives
Re: CVE-2016-4484: - Cryptsetup Initrd root Shell
From: John Haxby <john.haxby () oracle com>
Date: Wed, 16 Nov 2016 16:11:57 +0000
On 16/11/16 15:55, Jason Cooper wrote:
How does this differ from an attacker setting 'init=/bin/sh' on the kernel command line? Or, booting from attacker provided media? Or, in OS X, booting in single user mode? Your Discussion section at the end mentions facilities (GRUB passwords, BIOS passwords, etc) for preventing this "Developer friendliness". How do you envision the installer enabling these while providing a failsafe that an attacker can't exploit?
If you set a grub password then the attacker cannot set init=/bin/sh on the kernel command line without knowing the grub password. However, when the boot process prompts you for the encrypted volume password you can just hit enter until you eventually get a shell prompt. Of course, the attacker needs to be able to see the console where the password is typed in ... jch
Current thread:
- CVE-2016-4484: - Cryptsetup Initrd root Shell Hector Marco (Nov 14)
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell - Update: Dracut is also vulnerable Hector Marco-Gisbert (Nov 14)
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell Leo Famulari (Nov 14)
- Re: [FD] [oss-security] CVE-2016-4484: - Cryptsetup Initrd root Shell Hector Marco (Nov 15)
- Re: Re: [FD] [oss-security] CVE-2016-4484: - Cryptsetup Initrd root Shell Jeremy Stanley (Nov 15)
- Re: [FD] [oss-security] CVE-2016-4484: - Cryptsetup Initrd root Shell Hector Marco (Nov 15)
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell Jason Cooper (Nov 16)
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell John Haxby (Nov 16)
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell Jason Cooper (Nov 17)
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell John Haxby (Nov 17)
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell Jason Cooper (Nov 17)
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell John Haxby (Nov 17)
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell Jacobo Avariento (Nov 17)
- Linux encrypted boot security, was: CVE-2016-4484: - Cryptsetup Initrd root Shell Jason Cooper (Nov 18)
- Re: CVE-2016-4484: - Cryptsetup Initrd root Shell John Haxby (Nov 16)