Allow signed kernels to be kexec'ed under lockdown
Bug #1798441 reported by
Thadeu Lima de Souza Cascardo
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
linux (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Bionic |
Fix Released
|
Medium
|
Thadeu Lima de Souza Cascardo |
Bug Description
[Impact]
Under kernel lockdown, one can't kexec unless it's using kexec_file_load with a signed kernel.
[Test case]
It was verified that a signed kernel could be loaded with kexec -s, and properly booted.
[Regression Potential]
A security issue, as we allow more kernels to be loaded than we would like to. Though, that's already the case in cosmic.
CVE References
description: | updated |
Changed in linux (Ubuntu Bionic): | |
status: | New → In Progress |
importance: | Undecided → Medium |
assignee: | nobody → Thadeu Lima de Souza Cascardo (cascardo) |
Changed in linux (Ubuntu): | |
status: | Incomplete → In Progress |
Changed in linux (Ubuntu): | |
status: | In Progress → Fix Released |
Changed in linux (Ubuntu Bionic): | |
status: | In Progress → Fix Committed |
tags: |
added: kernel-fixup-verification-needed-bionic removed: verification-needed-bionic |
To post a comment you must log in.
This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:
apport-collect 1798441
and then change the status of the bug to 'Confirmed'.
If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.
This change has been made by an automated script, maintained by the Ubuntu Kernel Team.