Debian: Kernel packages include kernel module signing key
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
StarlingX |
Fix Released
|
Medium
|
Jiping Ma |
Bug Description
Brief Description
This is a security issue, because now everyone can sign and insert their own modules into the kernel, even on systems with UEFI secure boot and/or the lockdown kernel feature enabled.
Severity
Major, due to the security impact
Steps to Reproduce
sysadmin@
Linux yow2-xr11-001 5.10.0-6-rt-amd64 #1 SMP PREEMPT_RT StarlingX Debian 5.10.112-1.stx.22 (2022-09-23 x86_64 GNU/Linux
$sysadmin@
/usr/src/
/usr/src/
sysadmin@
linux-rt-
Expected Behavior
Signing keys should not be available in installed systems.
Actual Behavior
Kernel module signing keys are available in the linux-kbuild-5.10 and linux-rt-
Reproducibility
Reproducible on Debian-based starlingx.
System Configuration
Not applicable.
Load info (eg: 2022-03-
Not applicable.
Last Pass
Timestamp/Logs
None.
Alarms
Not applicable.
Test Activity
Normal use.
Workaround
None.
Changed in starlingx: | |
assignee: | nobody → Jiping Ma (jma11) |
Changed in starlingx: | |
importance: | Undecided → Medium |
tags: | added: stx.8.0 stx.debian stx.distro.other |
Fix proposed to branch: master /review. opendev. org/c/starlingx /kernel/ +/861822
Review: https:/