Re: CVE-2016-4484: - Cryptsetup Initrd root Shell

[Jacobo Avariento <spinfoo.vuln () gmail com>]

Good debate.

Actually when using full disk encryption, to lock the BIOS and GRUB must
be mandatory, otherwise you are protecting your confidentiality but not
your integrity. Even with a password in GRUB with an unprotected BIOS
you can also boot from a USB device and access encrypted partitions,
delete them, etc.

Just to mention another method complimentary to the "rd.shell=0" a
similar behaviour to this "flaw" can be achieved using at the boot
sequence "rd.break=pre-udev", this also gives you a root shell with
access to the hard disk.

Regards


On 11/17/2016 02:15 PM, John Haxby wrote:
> On 17/11/16 17:50, Jason Cooper wrote:
> > Hi John,
> >
> > On Thu, Nov 17, 2016 at 04:56:06PM +0000, John Haxby wrote:
> > > > On 17/11/16 16:39, Jason Cooper wrote:
> > > > > > However, the golden rule still applies.  Physical access trumps all
> > > > > > defensive measures.  The absolute best you can do is detect that
> > > > > > physical access occurred.  From there, you're hoping there are no
> > > > > > hardware implants or other devices outside the scope of software
> > > > > > security.
> > > > I agree.  However, it ought be to be harder than leaning on the enter
> > > > key to break into a system.  You lock your doors even though it doesn't
> > > > stop a determined burglar?
> > Yes, as I said before, non-deterministic failure modes are bad.  This
> > CVE is a bug in the initrd script and needs to be fixed.  What I
> > disagree with, and still do, is the "sky is falling!" nature of the
> > alert.
> Yup.  I agree there, but that's down to the publicity its received.  We
> can't do much but grin and bear that.   Red Hat have given this a CVSS2
> score of 7.2 which reflects the _potential_ severity but marked it as
> "moderate" which reflects the actual effect.   It's most serious for
> people like me who have an encrypted root but no grub password (and no
> rd.shell=0) but, no, the sky is not falling.
>
> jch

-- 
https://github.com/spinfoo
https://pa.linkedin.com/in/jacoboavariento