linux-kernel - Re: [PATCH] certs: Prevent spurious errors on repeated blacklisting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 9 Nov 2022 15:50:33 +0000
From:   Eric Snowberg <eric.snowberg@...cle.com>
To:     Mickaël Salaün <mic@...ikod.net>
CC:     Thomas Weißschuh <linux@...ssschuh.net>,
        David Howells <dhowells@...hat.com>,
        David Woodhouse <dwmw2@...radead.org>,
        Jarkko Sakkinen <jarkko@...nel.org>,
        "keyrings@...r.kernel.org" <keyrings@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Mark Pearson <markpearson@...ovo.com>,
        "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>,
        "linux-security-module@...r.kernel.org" 
        <linux-security-module@...r.kernel.org>
Subject: Re: [PATCH] certs: Prevent spurious errors on repeated blacklisting



> On Nov 7, 2022, at 6:12 AM, Mickaël Salaün <mic@...ikod.net> wrote:
> 
> This is a follow-up of https://lore.kernel.org/r/c8c65713-5cda-43ad-8018-20f2e32e4432@t-8ch.de
> 
> Added Jarkko, Mark Pearson, Eric Snowberg and more ML in Cc.
> 
> 
> On 04/11/2022 02:47, Thomas Weißschuh wrote:
>> When the blacklist keyring was changed to allow updates from the root
>> user it gained an ->update() function that disallows all updates.
>> When the a hash is blacklisted multiple times from the builtin or
>> firmware-provided blacklist this spams prominent logs during boot:
>> [    0.890814] blacklist: Problem blacklisting hash (-13)
>> As all these repeated calls to mark_raw_hash_blacklisted() would create
>> the same keyring entry again anyways these errors can be safely ignored.
> 
> These errors can indeed be safely ignored, however they highlight issues with some firmware vendors not checking nor optimizing their blocked hashes. This raises security concerns, and it should be fixed by firmware vendors.

I have seen error reports like this in the past.  Some of the older UEFI Revocation List 
files up on the UEFI.org site [1] contain duplicates.  If a firmware vendor uses one of 
these older Microsoft signed files, they are going to see these error messages.

1. https://uefi.org/revocationlistfile/archive