linux-kernel - Re: [External] Re: [BUG] blacklist: Problem blacklisting hash (-13) during boot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <860048ca-d827-4319-9755-9b44ba3c4157@t-8ch.de>
Date:   Sat, 25 Feb 2023 22:28:56 -0600 (CST)
From:   Thomas Weißschuh  <thomas@...ch.de>
To:     Jeremy Kerr <jk@...econstruct.com.au>
Cc:     Mark Pearson <markpearson@...ovo.com>,
        Mickaël Salaün <mic@...ikod.net>,
        Jarkko Sakkinen <jarkko@...nel.org>,
        David Howells <dhowells@...hat.com>,
        David Woodhouse <dwmw2@...radead.org>,
        keyrings@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-security-module <linux-security-module@...r.kernel.org>,
        linux-integrity@...r.kernel.org
Subject: Re: [External] Re: [BUG] blacklist: Problem blacklisting hash (-13)
 during boot

Hi,

Feb 25, 2023 21:42:54 Jeremy Kerr <jk@...econstruct.com.au>:

> Hi Mark,
>
>> I have flagged this to the FW team (LO-2105) to get their feedback
>> and see if we can get it addressed on our platforms.
>
> Any progress from the FW team about this? I have a fresh-out-of-the-box
> T14s with this issue, there's 33 duplicated hashes in dbx:
>
> $ mokutil --dbx | grep -E '[[:xdigit:]]{64}' | sort | uniq -cd
> [...]
>
> - and so generating 33 KERN_ERR messages on boot.
>
> Given there's (at least) a few months' worth of GA machines with this
> issue, can we suppress the warning?

In 6.3 this message will be downgraded to a warning.
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c95e8f6fd157b45ef0685c221931561e943e82da

A fixed firmware is still desirable, though.

Thomas