linux-kernel - Re: 2.6.23-rc1: no setup signature found...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <46A8E3F9.5070809@zytor.com>
Date:	Thu, 26 Jul 2007 11:12:09 -0700
From:	"H. Peter Anvin" <hpa@...or.com>
To:	bbpetkov@...oo.de
CC:	Xudong Guan <xudong.guan@...il.com>, linux-kernel@...r.kernel.org
Subject: Re: 2.6.23-rc1: no setup signature found...

Borislav Petkov wrote:
> 
>> What distro/version of grub are you running?  
> Debian unstable
>> I'm wondering if there are
>> some old version of grub out there which did the "load four sectors"
>> way-anciently-obsolete crap; the other possibility that comes to mind is
>> setting up the stack in an invalid manner.
> grub version:
> 
> [boris@...lum:18:17:27:->  apt-cache show grub
> Package: grub
> Priority: optional
> Section: admin
> Installed-Size: 708
> Maintainer: Grub Maintainers <pkg-grub-devel@...ts.alioth.debian.org>
> Architecture: i386
> Version: 0.97-29
> Depends: libc6 (>= 2.5-5), libncurses5 (>= 5.4-5)
> Suggests: grub-doc, mdadm
> Filename: pool/main/g/grub/grub_0.97-29_i386.deb
> Size: 366884
> MD5sum: 2da7a5942db06eaba046dff4615bcce9
> SHA1: 7f4da793da209d011ce94fceebaebe0e5f08790f
> SHA256: 2596782c08f1f7365e9935f687fef74c67d8702503188f22448db9f0ac98e18e
> Description: GRand Unified Bootloader
> ...

This concerns me deeply.  This is a current version of Grub which
shouldn't have any silly 8K limitations.  Yet it appears to have a
similar pathology over the ancient version Xudong just described.

The absolute best would be if we could replicate this in simulation
(Bochs or Qemu); this would make it very simple to debug.  Would you be
willing to try to do that?

	-hpa

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/