Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <c3d2c492-8f94-f84e-1042-ca3e7663567e@oracle.com>
Date: Wed, 16 Nov 2016 16:11:57 +0000
From: John Haxby <john.haxby@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2016-4484: - Cryptsetup Initrd root Shell

On 16/11/16 15:55, Jason Cooper wrote:
> How does this differ from an attacker setting 'init=/bin/sh' on the
> kernel command line?  Or, booting from attacker provided media?  Or, in
> OS X, booting in single user mode?
> 
> Your Discussion section at the end mentions facilities (GRUB passwords,
> BIOS passwords, etc) for preventing this "Developer friendliness".  How
> do you envision the installer enabling these while providing a failsafe
> that an attacker can't exploit?

If you set a grub password then the attacker cannot set init=/bin/sh on
the kernel command line without knowing the grub password.   However,
when the boot process prompts you for the encrypted volume password you
can just hit enter until you eventually get a shell prompt.  Of course,
the attacker needs to be able to see the console where the password is
typed in ...

jch

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.