Revoke & rotate to new signing key
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
linux (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Bionic |
Fix Released
|
High
|
Unassigned | ||
Focal |
Fix Released
|
High
|
Unassigned | ||
Jammy |
Fix Released
|
High
|
Unassigned | ||
Kinetic |
Fix Released
|
High
|
Unassigned |
Bug Description
[ Impact ]
* Revoke & rotate to new signing key
* Update revocations, which match the next Ubuntu shim 15.7 revocations. Specifically - revoke certs that were previously protected with by-hash revocations, revoke lost/unused certificates.
* Start using advantage2021v1 and ubuntu2022v1 signing keys.
* This is a routine key rotation.
[ Test Plan ]
* Check that old shim/grub boot this kernel
* Check that the upcomming future shim/grub can boot this kernel
* Check that these kernels can do signed kexec into itself
[ Where problems could occur ]
* Kernels with this patch applied should be signed using ubuntu/4 pro/3 core/2 signing streams.
[ Other Info ]
* TPM PCR values and measurements will change when changing the signing key
CVE References
Changed in linux (Ubuntu): | |
status: | New → Triaged |
Changed in linux (Ubuntu Kinetic): | |
importance: | Undecided → High |
status: | New → Fix Committed |
Changed in linux (Ubuntu Jammy): | |
importance: | Undecided → High |
status: | New → Fix Committed |
Changed in linux (Ubuntu Focal): | |
importance: | Undecided → High |
status: | New → Fix Committed |
Changed in linux (Ubuntu Bionic): | |
importance: | Undecided → High |
status: | New → Fix Committed |
tags: | added: kernel-spammed-bionic-linux-raspi2 |
tags: |
added: verification-done-bionic verification-done-focal verification-done-jammy verification-done-kinetic removed: verification-needed-bionic verification-needed-focal verification-needed-jammy verification-needed-kinetic |
tags: | added: kernel-stable-tracking-bug |
tags: | removed: verification-done-jammy |
tags: | removed: verification-done-focal |
tags: | removed: verification-done-kinetic |
This bug is awaiting verification that the linux/5.19.0-31.32 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification- needed- kinetic' to 'verification- done-kinetic' . If the problem still exists, change the tag 'verification- needed- kinetic' to 'verification- failed- kinetic' .
If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.
See https:/ /wiki.ubuntu. com/Testing/ EnableProposed for documentation how to enable and use -proposed. Thank you!