Merge ~eslerm/ubuntu-cve-tracker:grub2-boilerplate into ubuntu-cve-tracker:master

[Mark Esler]

grub2* boilerplate init

trusty/esm_grub2 and trusty/esm_grub2-unsigned require a justification. This justification should be in the UEFI meeting notes from 2022-09-22, but I need access.

xnox suggested tracking secureboot-db on all grub cves. grub vulnerabilities and loading vulnerable-non-revoked software are separate issues, so I made separate boilerplate.

However, the importance of secureboot-db cannot be lost. An evil housekeeper attack becomes possible as soon as *a* bypass (CVE) is found in grub2-current and this is not resolved until old keys are revoked. We have no tooling to track when this occurs. (there has never been a -security release for secureboot-db)

[Mark Esler (eslerm)]

shim should also be tracked

[Mark Esler (eslerm)]

CVE-2020-15705 [0] and CVE-2021-3418 [1] are duplicates, except they are related to Grub prior to 2.04 and 2.06 respectively. Each are for evil housekeeper attacks based on shims (i.e., BlackLotus like). They are assigned after a grub2 CVE is discovered in the previous version.

These CVEs should be used to track secureboot-db and shim.

Canonical is the CNA for CVE-2020-15705. I believe we need to amend our CVE publication. CVE-2021-3418 was assigned by RedHat and follows the previous CVEs description. Ubuntu is affected by both, but UCT does not track this yet.

Tooling is needed to explain the difference between grub2 and secureboot-db differences to CVE triagers.

[0] https://nvd.nist.gov/vuln/detail/CVE-2020-15705
[1] https://nvd.nist.gov/vuln/detail/CVE-2021-3418

[Dimitri John Ledkov (xnox)]

> trusty/esm_grub2: ignored (JUSTIFICATION NEEDED)

We cannot update secureboot-db because it would invalidate installer media, just like other ESM. We cannot update to new signing keys of kernel for trusty because GA trusty kernel lacks features needed by the new keys signing policies. This leaves grub as pointless to update, sort of, as it can be always circumvented. Separately secureboot on servers on Trusty is rarely used, making patching it sort of useless too. In essence it is patching grub in trusty would only give a false sense of security.

We could upgrade grub2 to the new grub2-unsigned split. But that doesn't solve the installer problem.

I agree with everything else in the templates. I wonder if trusty ones need unique explanation or assesment. Or like case by case patching only if it affects secureboot.

[Mark Esler (eslerm)]

> In essence it is patching grub in trusty would only give a false sense of security.

This is true for xenial too, except kernel support is not a factor.

On one hand, I would like to patch all the holes in the fence even if the gate is open. Potentially, someone could use a fresh key to lock the gate. On the other hand, this effort could be placed elsewhere. There is little demand for custom keys.

[Mark Esler (eslerm)]

The only case I have heard of others signing their own keys for Ubuntu Secure Boot are interested in the latest FIPS support. The scenario is unlikely and, when it does occur, is unlikely to use ESM.

[Steve Langasek (vorlon)]

review: Approve

[Chris Coulson (chrisccoulson)]

This looks ok - I've added a couple of minor comments.

review: Approve

diff --git a/boilerplates/grub2 b/boilerplates/grub2
new file mode 100644
index 0000000..d0926e1
--- /dev/null
+++ b/boilerplates/grub2
@@ -0,0 +1,61 @@
+Candidate:
+PublicDate:
+References:
+Description:
+Ubuntu-Description:
+Notes:
+ eslerm> grub2-unsigned contains Secure Boot security fixes
+ eslerm> the grub2 package unlikely affects Ubuntu's Secure Boot
+ eslerm> grub2 and grub2-unsigned should have same major version
+ eslerm> Ubuntu Secure Boot and ESM do not cover i386
+ eslerm> trusty's GA kernel cannot handle new versions of grub
+ eslerm| Note that key revocation is required to protect against
+   evil housekeeper attacks (such as BlackLotus)
+Mitigation:
+Bugs:
+Priority: untriaged
+Discovered-by:
+Assigned-to:
+CVSS:
+
+Patches_grub2:
+upstream_grub2: needs-triage
+trusty_grub2: ignored (end of standard support)
+trusty/esm_grub2: ignored (update incompatible with kernel)
+xenial_grub2: ignored (end of standard support)
+esm-infra/xenial_grub2: needs-triage
+bionic_grub2: ignored (end of standard support)
+esm-infra/bionic_grub2: needs-triage
+focal_grub2: needs-triage
+jammy_grub2: needs-triage
+kinetic_grub2: needs-triage
+lunar_grub2: needs-triage
+devel_grub2: needs-triage
+
+Patches_grub2-unsigned:
+upstream_grub2-unsigned: needs-triage
+trusty_grub2-unsigned: ignored (end of standard support)
+trusty/esm_grub2-unsigned: ignored (update incompatible with kernel)
+xenial_grub2-unsigned: ignored (end of standard support)
+esm-infra/xenial_grub2-unsigned: needs-triage
+bionic_grub2-unsigned: ignored (end of standard support)
+esm-infra/bionic_grub2-unsigned: needs-triage
+focal_grub2-unsigned: needs-triage
+jammy_grub2-unsigned: needs-triage
+kinetic_grub2-unsigned: needs-triage
+lunar_grub2-unsigned: needs-triage
+devel_grub2-unsigned: needs-triage
+
+Patches_grub2-signed:
+upstream_grub2-signed: needs-triage
+trusty_grub2-signed: DNE
+trusty/esm_grub2-signed: DNE
+xenial_grub2-signed: ignored (end of standard support)
+esm-infra/xenial_grub2-signed: needs-triage
+bionic_grub2-signed: ignored (end of standard support)
+esm-infra/bionic_grub2-signed: needs-triage
+focal_grub2-signed: needs-triage
+jammy_grub2-signed: needs-triage
+kinetic_grub2-signed: needs-triage
+lunar_grub2-signed: needs-triage
+devel_grub2-signed: needs-triage
diff --git a/boilerplates/grub2-signed b/boilerplates/grub2-signed
new file mode 120000
index 0000000..d0335b0
--- /dev/null
+++ b/boilerplates/grub2-signed
@@ -0,0 +1 @@
+grub2
\ No newline at end of file
diff --git a/boilerplates/grub2-unsigned b/boilerplates/grub2-unsigned
new file mode 120000
index 0000000..d0335b0
--- /dev/null
+++ b/boilerplates/grub2-unsigned
@@ -0,0 +1 @@
+grub2
\ No newline at end of file
diff --git a/boilerplates/secureboot-db b/boilerplates/secureboot-db
new file mode 100644
index 0000000..5dcf370
--- /dev/null
+++ b/boilerplates/secureboot-db
@@ -0,0 +1,57 @@
+Candidate:
+PublicDate:
+References:
+Description:
+Ubuntu-Description:
+Notes:
+ eslerm> secureboot-db should only ever be updated after shim
+ eslerm| secureboot-db is not updated on ESM releases as doing so
+   would revoke install media keys
+ eslerm| Note that key revocation is required to protect against
+   evil housekeeper attacks (such as BlackLotus)
+Mitigation:
+Bugs:
+Priority: untriaged
+Discovered-by:
+Assigned-to:
+CVSS:
+
+Patches_secureboot-db:
+upstream_secureboot-db: needs-triage
+trusty_secureboot-db: ignored (end of standard support)
+trusty/esm_secureboot-db: ignored (install media keys will never be revoked)
+xenial_secureboot-db: ignored (end of standard support)
+esm-infra/xenial_secureboot-db: ignored (install media keys will never be revoked)
+bionic_secureboot-db: ignored (end of standard support)
+esm-infra/bionic_secureboot-db: needs-triage
+focal_secureboot-db: needs-triage
+jammy_secureboot-db: needs-triage
+kinetic_secureboot-db: needs-triage
+lunar_secureboot-db: needs-triage
+devel_secureboot-db: needs-triage
+
+Patches_shim-signed:
+upstream_shim-signed: needs-triage
+trusty_shim-signed: ignored (end of standard support)
+trusty/esm_shim-signed: ignored (install media keys will never be revoked)
+xenial_shim-signed: ignored (end of standard support)
+esm-infra/xenial_shim-signed: ignored (install media keys will never be revoked)
+bionic_shim-signed: ignored (end of standard support)
+esm-infra/bionic_shim-signed: needs-triage
+focal_shim-signed: needs-triage
+jammy_shim-signed: needs-triage
+lunar_shim-signed: needs-triage
+devel_shim-signed: needs-triage
+
+Patches_shim:
+upstream_shim: needs-triage
+trusty_shim: ignored (end of standard support)
+trusty/esm_shim: ignored (install media keys will never be revoked)
+xenial_shim: ignored (end of standard support)
+esm-infra/xenial_shim: ignored (install media keys will never be revoked)
+bionic_shim: ignored (end of standard support)
+esm-infra/bionic_shim: needs-triage
+focal_shim: needs-triage
+jammy_shim: needs-triage
+lunar_shim: needs-triage
+devel_shim: needs-triage
diff --git a/boilerplates/shim b/boilerplates/shim
new file mode 120000
index 0000000..0eead1e
--- /dev/null
+++ b/boilerplates/shim
@@ -0,0 +1 @@
+secureboot-db
\ No newline at end of file
diff --git a/boilerplates/shim-signed b/boilerplates/shim-signed
new file mode 120000
index 0000000..0eead1e
--- /dev/null
+++ b/boilerplates/shim-signed
@@ -0,0 +1 @@
+secureboot-db
\ No newline at end of file