Comment 0 for bug 1928679
Revision history for this message
| Dimitri John Ledkov (xnox) wrote Supporting importing dbx keys into revocation list from mok table | #0 |
© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
9199653
demo site
(Get the code!)
[Impact]
* Ubuntu's 15.4 based shim ships a very large vendor-dbx (aka mokx) which revokes many Ubuntu kernel hashes and 2012 signing key.
* Kernel should import those into it's %:.blacklist keyring such that it prohibits signed kexec of the revoked kernels.
* v5.13-rc1 kernel has learned how to import mokx and how to import full certs into the %:.blacklist keyring.
* However, it only does so by reading MokListXRT efi variable.
* Due to the large size of Ubuntu's vendor-dbx, shim does not create MokListXRT efi variable, but instead creates MokListXRT1 MokListXRT2 MokListXRT3 which currently v5.13-rc1 kernel cannot read. Shim also exposes MokListXRT via mokvar table, which is easier to parse and contains all the revocations in full. Kernel needs a patch to read MokListXRT via mokvar table.
* We have two options on how to proceed from here, either we include the same hashes and certs as our vendordbx in in the kernel as revocation list, or we fix kernel to read MokListXRT via mokvar table
* The above is known as CVE-2020-26541
* Separately it would be nice to add informational dmesg messages when revoking signing certificates, as a good indication that signing key rotation events have happened and have been applied correctly.
[Test Plan]
* Boot kernel with 15.4 based Ubuntu shim
* Install keyutils package
* Execute $ sudo keyctl list %:.blacklist it should list in exccess of 300+ hash entries. It also must list assymetric Canonical signing key from 2012.
* Separately check dmesg to observe that asymmetric canonical signing key from 2012 is revoked.
[Where problems could occur]
* EFI variable storage can be full thus preventing shim to mirror efivars and the moktable. On decent hardware this should not happen, but has been observed to be corrupted on some older EDKII based OVMF instances with small EFI variable storage space (pre-4MB).
[Other Info]
* The patches to fix the above have been submitted upstream
https://<email address hidden>/
https://<email address hidden>/
This will now be submitted as SAUCE patches for the Ubuntu UNSTABLE kernel, until accepted upstream.