Grub security situation
Hello,
The latest pkg-stats scan reported to me a number of grub2 security issues:
grub2 | CVE-2024-45778 | https://security-tracker.debian.org/tracker/CVE-2024-45778 grub2 | CVE-2024-45782 | https://security-tracker.debian.org/tracker/CVE-2024-45782 grub2 | CVE-2024-45779 | https://security-tracker.debian.org/tracker/CVE-2024-45779 grub2 | CVE-2024-45780 | https://security-tracker.debian.org/tracker/CVE-2024-45780 grub2 | CVE-2025-0678 | https://security-tracker.debian.org/tracker/CVE-2025-0678
Looking at that in some details, there are in fact a LOT more CVEs:
https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html
Many of them are not reported by pkg-stats because NVD has not annotated those CVEs (meh).
Now when it becomes a bit tricky is that those CVEs are fixed by 73 patches. All of them have been applied upstream, but they are apparently not trivial to backport on grub 2.12.
See Arch people complaining here:
https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00124.html
https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00098.html
There are currently 284 commits in grub's master on top of the 2.12 version we're using. Backporting the 73 patches fixing the security issues seems complicated, and having all 284 commits as patches in Buildroot also seems not very practical.
So the only solution that I can see right now is to used grub's master branch (of course with a fixed commit). Of course, for 2025.02, this means we would bump grub to a newer version that not only has security fixes, but also a whole bunch of other random changes. But that's how grub is maintained, and I'm not sure what we can do about it.
Opinions? Thoughts? Suggestions?
Thomas
Signature · 7 lines
Thomas Petazzoni, co-owner and CEO, Bootlin Embedded Linux and Kernel engineering and training https://bootlin.com _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Quoted 22 lines · Thomas Petazzoni
Hello,
The latest pkg-stats scan reported to me a number of grub2 security issues:
grub2 | CVE-2024-45778 | https://security-tracker.debian.org/tracker/CVE-2024-45778 grub2 | CVE-2024-45782 | https://security-tracker.debian.org/tracker/CVE-2024-45782 grub2 | CVE-2024-45779 | https://security-tracker.debian.org/tracker/CVE-2024-45779 grub2 | CVE-2024-45780 | https://security-tracker.debian.org/tracker/CVE-2024-45780 grub2 | CVE-2025-0678 | https://security-tracker.debian.org/tracker/CVE-2025-0678Looking at that in some details, there are in fact a LOT more CVEs:
https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.htmlMany of them are not reported by pkg-stats because NVD has not annotated those CVEs (meh).
Now when it becomes a bit tricky is that those CVEs are fixed by 73 patches. All of them have been applied upstream, but they are apparently not trivial to backport on grub 2.12.
Quoted 8 lines
See Arch people complaining here:
https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00124.html https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00098.htmlThere are currently 284 commits in grub's master on top of the 2.12 version we're using. Backporting the 73 patches fixing the security issues seems complicated,
Debian trixie also has 2.12, and there are 71 patches there [1]. So perhaps
tracking Debian is an option? I think we used to do that for grub before:
GRUB_SOURCE = grub_$(GRUB_VERSION).orig.tar.gzGRUB_PATCH = grub_$(GRUB_VERSION)-68.diff.gzGRUB_SITE = http://snapshot.debian.org/archive/debian/20141023T043132Z/pool/main/g/grub
Regards,
Arnout
[1] https://salsa.debian.org/grub-team/grub/-/tree/master/debian/patches/cve-2025-jan?ref_type=heads
Quoted 9 lines
and having all 284 commits as patches in
Buildroot also seems not very practical.So the only solution that I can see right now is to used grub's master branch (of course with a fixed commit). Of course, for 2025.02, this means we would bump grub to a newer version that not only has security fixes, but also a whole bunch of other random changes. But that's how grub is maintained, and I'm not sure what we can do about it.
Quoted 3 lines
Opinions? Thoughts? Suggestions?
Thomas
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Thomas" == Thomas Petazzoni <[email protected]> writes:
Hi,
Quoted 7 lines
So the only solution that I can see right now is to used grub's master branch (of course with a fixed commit). Of course, for 2025.02, this means we would bump grub to a newer version that not only has security fixes, but also a whole bunch of other random changes. But that's how grub is maintained, and I'm not sure what we can do about it.
Opinions? Thoughts? Suggestions?
It sucks, but grub2 doesn't seem very alive and well maintained nowdays. From the mails above it sounded like the current git version had some regressions compared to 2.12, so using git doesn't sound that great.
Arnouts suggestion about piggy banking on Debian could be an option, or alternatively we could simply drop grub2? With EFI I guess there is less need for grub2 anyway?
Signature · 5 lines
Bye, Peter Korsgaard _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Quoted 13 lines · Peter Korsgaard
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
"Thomas" == Thomas Petazzoni <[email protected]> writes:
Hi,
Quoted 7 lines
So the only solution that I can see right now is to used grub's master branch (of course with a fixed commit). Of course, for 2025.02, this means we would bump grub to a newer version that not only has security fixes, but also a whole bunch of other random changes. But that's how grub is maintained, and I'm not sure what we can do about it.
Opinions? Thoughts? Suggestions?
Quoted 7 lines
It sucks, but grub2 doesn't seem very alive and well maintained nowdays. From the mails above it sounded like the current git version had some regressions compared to 2.12, so using git doesn't sound that great.
Arnouts suggestion about piggy banking on Debian could be an option, or alternatively we could simply drop grub2? With EFI I guess there is less need for grub2 anyway?
Probably just best to keep the package and just mark it as having some known security issues.
I'm assuming these are security issues that are in most cases relatively unlikely to be exploited in practice.
Quoted 7 lines
--
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
+1 track debian for what it's worth
Lance
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
Hi,
I am involved in some new project, which is using Buildroot and Grub. So I vote for keep grub with pointing to git master as Thomas suggested.
best regards
Waldemar
Lance Fredrickson wrote,
Quoted 8 lines
+1 track debian for what it's worth
Lance
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot