[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <c3d2c492-8f94-f84e-1042-ca3e7663567e@oracle.com>
Date: Wed, 16 Nov 2016 16:11:57 +0000
From: John Haxby <john.haxby@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2016-4484: - Cryptsetup Initrd root Shell
On 16/11/16 15:55, Jason Cooper wrote:
> How does this differ from an attacker setting 'init=/bin/sh' on the
> kernel command line? Or, booting from attacker provided media? Or, in
> OS X, booting in single user mode?
>
> Your Discussion section at the end mentions facilities (GRUB passwords,
> BIOS passwords, etc) for preventing this "Developer friendliness". How
> do you envision the installer enabling these while providing a failsafe
> that an attacker can't exploit?
If you set a grub password then the attacker cannot set init=/bin/sh on
the kernel command line without knowing the grub password. However,
when the boot process prompts you for the encrypted volume password you
can just hit enter until you eventually get a shell prompt. Of course,
the attacker needs to be able to see the console where the password is
typed in ...
jch
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
