CVE-2015-8370

Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error.

A flaw was found in the way the grub2 handled backspace characters entered in username and password prompts. An attacker with access to the system console could use this flaw to bypass grub2 password protection and gain administrative access to the system (CVE-2015-8370).

These are all security issues fixed in the grub2-2.02~beta3-15.1 package on the GA media of openSUSE Tumbleweed.

This update for grub2 provides the following fixes:

A security issues with a bufferoverflow when reading username and password was fixed (bsc#956631, CVE-2015-8370)

Also following bugs were fixed:

• Fix buffer overflows when reading username and password. (bsc#956631, CVE-2015-8370)
• Expand list of grub.cfg search path in PV Xen guests for systems installed on btrfs snapshots. (bsc#946148, bsc#952539)
• Add grub.xen config searching path on boot partition. (bsc#884828)
• Add linux16 and initrd16 to grub.xen. (bsc#884830)

This update for grub2 provides the following fixes:

A security issues with a bufferoverflow when reading username and password was fixed (bsc#956631, CVE-2015-8370)

Bugs fixed:

• Expand list of grub.cfg search path in PV Xen guests for systems installed on btrfs snapshots. (bsc#946148, bsc#952539)
• Add grub.xen config searching path on boot partition. (bsc#884828)
• Add linux16 and initrd16 to grub.xen. (bsc#884830)

• Fix buffer overflows when reading username and password. (bsc#956631, CVE-2015-8370)
• Check MS-DOS header to find PE file header. (bsc#954126)
• Use dirname for copying Xen kernel and initrd to esp. (bsc#955493)
• Fix reading password by grub2-mkpasswd-pbdk2 without controlling tty. (bsc#954519)
• Add luks, gcry_rijndael and gcry_sha1 to signed EFI image to support LUKS partition in default setup. (bsc#917427, bsc#955609)
• Expand list of grub.cfg search path in PV Xen guests for systems installed on btrfs snapshots. (bsc#946148, bsc#952539)

This update for grub2 provides the following fixes and enhancements:

Security issue fixed:

• Fix buffer overflows when reading username and password. (bsc#956631, CVE-2015-8370)

Non security issues fixed:

• Expand list of grub.cfg search path in PV Xen guests for systems installed on btrfs snapshots. (bsc#946148, bsc#952539)
• Add --image switch to force zipl update to specific kernel. (bsc#928131)
• Do not use shim lock protocol for reading PE header as it won't be available when secure boot is disabled. (bsc#943380)
• Make firmware flaw condition be more precisely detected and add debug message for the case.

Hector Marco and Ismael Ripoll discovered that GRUB incorrectly handled the backspace key when configured to use authentication. A local attacker could use this issue to bypass GRUB password protection.