Build using distro minilzo
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
grub2 (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Focal |
Fix Released
|
Undecided
|
Unassigned | ||
Groovy |
Fix Released
|
Undecided
|
Unassigned | ||
Hirsute |
Fix Released
|
Undecided
|
Unassigned | ||
grub2-signed (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Focal |
Fix Released
|
Undecided
|
Unassigned | ||
Groovy |
Fix Released
|
Undecided
|
Unassigned | ||
Hirsute |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
[Impact]
* grub2 builds freestanding libc-less minilzo library to be used by the bootloader code.
* It has a vendorized copy of it, whilst the distribution has newer copies of it.
* Specifically distribution build has FTBFS fixes for new compiler and CVE fixes, specifically https:/
CVE-2014-4607
* Building grub with minilzo from the archive seems to be the best way to keep minilzo up to date and secure
[Test Case]
* Check that grub can open lzo compressed files in the command line prompt, for example by having /boot on btrfs filesystem with compress=lzo option.
[Where problems could occur]
* Changes limited to lzo compression, so for example grub may fail to mount / read data off btrfs filesystem with compress=lzo
[Other Info]
Fixed in:
hirsute grub2 2.04-1ubuntu37
groovy grub2 2.04-1ubuntu35.2
focal grub2 2.04-1ubuntu26.8
hirsute grub2-signed 1.157
groovy grub2-signed 1.155.2
focal grub2-signed 1.142.10
CVE References
description: | updated |
description: | updated |
Changed in grub2 (Ubuntu Hirsute): | |
status: | New → Fix Released |
Changed in grub2-signed (Ubuntu Hirsute): | |
status: | New → Fix Released |
information type: | Public → Public Security |
Changed in grub2-signed (Ubuntu Groovy): | |
status: | Fix Committed → Fix Released |
description: | updated |
I guess the way it's done might be a bit confusing at first, since not sure if it will be completely obvious from first glance that not the vendored minilzo is used but instead the sources are overwritten via debian/rules. Maybe a mention in README.source could be useful. On the other hand, I think stuff in grub2 is already very confusing so oh well. Let's just proceed!