[ubuntu/groovy-proposed] grub2_2.04-1ubuntu42_amd64.tar.gz - (Accepted)
Dimitri John Ledkov
xnox at ubuntu.com
Tue Mar 2 19:11:04 UTC 2021
grub2-unsigned (2.04-1ubuntu42) hirsute; urgency=medium
* SECURITY UPDATE: acpi command allows privilleged user to load crafted
ACPI tables when secure boot is enabled.
- 0126-acpi-Don-t-register-the-acpi-command-when-locked-dow.patch: Don't
register the acpi command when secure boot is enabled.
- CVE-2020-14372
* SECURITY UPDATE: use-after-free in rmmod command
- 0128-dl-Only-allow-unloading-modules-that-are-not-depende.patch: Don't
allow rmmod to unload modules that are dependencies of other modules.
- CVE-2020-25632
* SECURITY UPDATE: out-of-bound write in grub_usb_device_initialize()
- 0129-usb-Avoid-possible-out-of-bound-accesses-caused-by-m.patch
- CVE-2020-25647
* SECURITY UPDATE: Stack buffer overflow in grub_parser_split_cmdline
- 0206-kern-parser-Introduce-process_char-helper.patch,
0207-kern-parser-Introduce-terminate_arg-helper.patch,
0208-kern-parser-Refactor-grub_parser_split_cmdline-clean.patch,
0209-kern-buffer-Add-variable-sized-heap-buffer.patch,
0210-kern-parser-Fix-a-stack-buffer-overflow.patch: Add a variable
sized heap buffer type and use this.
- CVE-2020-27749
* SECURITY UPDATE: cutmem command allows privileged user to remove memory
regions when Secure Boot is enabled.
- 0127-mmap-Don-t-register-cutmem-and-badram-commands-when-.patch:
Don't register cutmem and badram commands when secure boot is enabled.
- CVE-2020-27779
* SECURITY UPDATE: heap out-of-bounds write in short form option parser.
- 0173-lib-arg-Block-repeated-short-options-that-require-an.patch:
Block repeated short options that require an argument.
- CVE-2021-20225
* SECURITY UPDATE: heap out-of-bound write due to mis-calculation of space
required for quoting.
- 0175-commands-menuentry-Fix-quoting-in-setparams_prefix.patch: Fix
quoting in setparams_prefix()
- CVE-2021-20233
* Partially backport the lockdown framework to restrict certain features
when secure boot is enabled.
* Backport various fixes for Coverity defects.
* Add SBAT metadata to the grub EFI binary.
- Backport patches to support adding SBAT metadata with grub-mkimage:
+ 0212-util-mkimage-Remove-unused-code-to-add-BSS-section.patch
+ 0213-util-mkimage-Use-grub_host_to_target32-instead-of-gr.patch
+ 0214-util-mkimage-Always-use-grub_host_to_target32-to-ini.patch
+ 0215-util-mkimage-Unify-more-of-the-PE32-and-PE32-header-.patch
+ 0216-util-mkimage-Reorder-PE-optional-header-fields-set-u.patch
+ 0217-util-mkimage-Improve-data_size-value-calculation.patch
+ 0218-util-mkimage-Refactor-section-setup-to-use-a-helper.patch
+ 0219-util-mkimage-Add-an-option-to-import-SBAT-metadata-i.patch
- Add debian/sbat.csv.in
- Update debian/build-efi-image and debian/rules
[ Dimitri John Ledkov & Steve Langasek LP: #1915536 ]
* Allow grub-efi-amd64|arm64 & -bin & -dbg be built by
src:grub2-unsigned (potentially of a higher version number).
* Add debian/rules generate-grub2-unsigned target to quickly build
src:grub2-unsigned for binary-copy backports.
* postinst: allow postinst to with with or without grub-multi-install
binary.
* postinst: allow using various grub-install options to achieve
--no-extra-removable.
* postinst: only call grub-check-signatures if it exists.
* control: relax dependency on grub2-common, as maintainer script got
fixed up to work with grub2-common/grub-common as far back as trusty.
* control: allow higher version depdencies from grub-efi package.
* dirs.in: create var/lib/grub/ucf in grub-efi-amd64 (and similar) as
postinst script uses that directory, and yet relies on grub-common to
create/ship it, which is not true in older releases. Also make sure
dh_installdirs runs after the .dirs files are generated.
Date: Tue, 23 Feb 2021 16:23:39 +0000
Changed-By: Dimitri John Ledkov <xnox at ubuntu.com>
Maintainer: Launchpad Build Daemon <buildd at lgw01-amd64-033.buildd>
-------------- next part --------------
Format: 1.8
Date: Tue, 23 Feb 2021 16:23:39 +0000
Source: grub2-unsigned
Binary: grub-efi-amd64 grub-efi-amd64-bin grub-efi-amd64-dbg
Built-For-Profiles: noudeb
Architecture: amd64
Version: 2.04-1ubuntu42
Distribution: hirsute
Urgency: medium
Maintainer: Launchpad Build Daemon <buildd at lgw01-amd64-033.buildd>
Changed-By: Dimitri John Ledkov <xnox at ubuntu.com>
Description:
grub-efi-amd64 - GRand Unified Bootloader, version 2 (EFI-AMD64 version)
grub-efi-amd64-bin - GRand Unified Bootloader, version 2 (EFI-AMD64 modules)
grub-efi-amd64-dbg - GRand Unified Bootloader, version 2 (EFI-AMD64 debug files)
Launchpad-Bugs-Fixed: 1915536
Changes:
grub2-unsigned (2.04-1ubuntu42) hirsute; urgency=medium
.
* SECURITY UPDATE: acpi command allows privilleged user to load crafted
ACPI tables when secure boot is enabled.
- 0126-acpi-Don-t-register-the-acpi-command-when-locked-dow.patch: Don't
register the acpi command when secure boot is enabled.
- CVE-2020-14372
* SECURITY UPDATE: use-after-free in rmmod command
- 0128-dl-Only-allow-unloading-modules-that-are-not-depende.patch: Don't
allow rmmod to unload modules that are dependencies of other modules.
- CVE-2020-25632
* SECURITY UPDATE: out-of-bound write in grub_usb_device_initialize()
- 0129-usb-Avoid-possible-out-of-bound-accesses-caused-by-m.patch
- CVE-2020-25647
* SECURITY UPDATE: Stack buffer overflow in grub_parser_split_cmdline
- 0206-kern-parser-Introduce-process_char-helper.patch,
0207-kern-parser-Introduce-terminate_arg-helper.patch,
0208-kern-parser-Refactor-grub_parser_split_cmdline-clean.patch,
0209-kern-buffer-Add-variable-sized-heap-buffer.patch,
0210-kern-parser-Fix-a-stack-buffer-overflow.patch: Add a variable
sized heap buffer type and use this.
- CVE-2020-27749
* SECURITY UPDATE: cutmem command allows privileged user to remove memory
regions when Secure Boot is enabled.
- 0127-mmap-Don-t-register-cutmem-and-badram-commands-when-.patch:
Don't register cutmem and badram commands when secure boot is enabled.
- CVE-2020-27779
* SECURITY UPDATE: heap out-of-bounds write in short form option parser.
- 0173-lib-arg-Block-repeated-short-options-that-require-an.patch:
Block repeated short options that require an argument.
- CVE-2021-20225
* SECURITY UPDATE: heap out-of-bound write due to mis-calculation of space
required for quoting.
- 0175-commands-menuentry-Fix-quoting-in-setparams_prefix.patch: Fix
quoting in setparams_prefix()
- CVE-2021-20233
* Partially backport the lockdown framework to restrict certain features
when secure boot is enabled.
* Backport various fixes for Coverity defects.
* Add SBAT metadata to the grub EFI binary.
- Backport patches to support adding SBAT metadata with grub-mkimage:
+ 0212-util-mkimage-Remove-unused-code-to-add-BSS-section.patch
+ 0213-util-mkimage-Use-grub_host_to_target32-instead-of-gr.patch
+ 0214-util-mkimage-Always-use-grub_host_to_target32-to-ini.patch
+ 0215-util-mkimage-Unify-more-of-the-PE32-and-PE32-header-.patch
+ 0216-util-mkimage-Reorder-PE-optional-header-fields-set-u.patch
+ 0217-util-mkimage-Improve-data_size-value-calculation.patch
+ 0218-util-mkimage-Refactor-section-setup-to-use-a-helper.patch
+ 0219-util-mkimage-Add-an-option-to-import-SBAT-metadata-i.patch
- Add debian/sbat.csv.in
- Update debian/build-efi-image and debian/rules
.
[ Dimitri John Ledkov & Steve Langasek LP: #1915536 ]
* Allow grub-efi-amd64|arm64 & -bin & -dbg be built by
src:grub2-unsigned (potentially of a higher version number).
* Add debian/rules generate-grub2-unsigned target to quickly build
src:grub2-unsigned for binary-copy backports.
* postinst: allow postinst to with with or without grub-multi-install
binary.
* postinst: allow using various grub-install options to achieve
--no-extra-removable.
* postinst: only call grub-check-signatures if it exists.
* control: relax dependency on grub2-common, as maintainer script got
fixed up to work with grub2-common/grub-common as far back as trusty.
* control: allow higher version depdencies from grub-efi package.
* dirs.in: create var/lib/grub/ucf in grub-efi-amd64 (and similar) as
postinst script uses that directory, and yet relies on grub-common to
create/ship it, which is not true in older releases. Also make sure
dh_installdirs runs after the .dirs files are generated.
Checksums-Sha1:
94bf3bd6578f722eb9169a97ac5f592581cc1d79 726836 grub-efi-amd64-bin_2.04-1ubuntu42_amd64.deb
632154af89c383b797093c760467fa58d21a24a6 3929072 grub-efi-amd64-dbg_2.04-1ubuntu42_amd64.deb
12248613b45dd6f18aab0803bc58b044bdd393a7 46920 grub-efi-amd64_2.04-1ubuntu42_amd64.deb
0b0b024d83ebf75b9220772482f411faa2af708c 15810 grub2-unsigned_2.04-1ubuntu42_amd64.buildinfo
4d49fef4139222e152fa29808ad0314e5b89b0b1 1562670 grub2_2.04-1ubuntu42_amd64.tar.gz
Checksums-Sha256:
42deebfa40bb9fee00cc92207d356f486486ca518ef27842d91f96482ead77ee 726836 grub-efi-amd64-bin_2.04-1ubuntu42_amd64.deb
eafee3f347e15f7684873716dcba6649f037fa9c6e22f41aed2301c28909ea45 3929072 grub-efi-amd64-dbg_2.04-1ubuntu42_amd64.deb
327b93d92ed5ebd3243a30e20cc4d69fde64ff3bc76e057c268a472408db089e 46920 grub-efi-amd64_2.04-1ubuntu42_amd64.deb
0c3dc50f36a76d996951a737a07b178ba133b4810cbd81b7d969204ee8238558 15810 grub2-unsigned_2.04-1ubuntu42_amd64.buildinfo
d6d666072ca07c8c92946b5f87bbd709f1132d8d7f43651e4c77a07af73e1a86 1562670 grub2_2.04-1ubuntu42_amd64.tar.gz
Files:
dd2c12e4c2ba98ea61f0bf0d2570dd1a 726836 admin optional grub-efi-amd64-bin_2.04-1ubuntu42_amd64.deb
cea1a4e67d39a9266b29f3e58771d761 3929072 debug optional grub-efi-amd64-dbg_2.04-1ubuntu42_amd64.deb
e455303d98681f21d8fff275f09bad74 46920 admin optional grub-efi-amd64_2.04-1ubuntu42_amd64.deb
992a63b9e8fc49137445131c87412437 15810 admin optional grub2-unsigned_2.04-1ubuntu42_amd64.buildinfo
ba02c474ebc87d93db7e89e0bf40e680 1562670 raw-uefi - grub2_2.04-1ubuntu42_amd64.tar.gz
Original-Maintainer: GRUB Maintainers <pkg-grub-devel at alioth-lists.debian.net>
More information about the Groovy-changes
mailing list