search

osresearch / safeboot

Scripts to slightly improve the security of the Linux boot process with UEFI Secure Boot and TPM support
https://safeboot.dev/
GNU General Public License v2.0
270 stars 28 forks source link

Device firmware signatures #71

Open osresearch opened 4 years ago

osresearch commented 4 years ago

The kernel firmware loader potentially allows a root user to load untrusted firmware into devices in the system. This was discussed as a vulnerability back in 2015 https://lwn.net/Articles/645823/ although nothing was ever merged. Kernel modules have to be signed, so it makes sense that the same mechanism could be used.

osresearch commented 4 years ago

Note that this is about the computer owner signing the firmware that they want to be loaded; the device might also validate an OEM signature before loading the firmware. The owner wants to prevent rollback attacks to previous vulnerable versions, or if the device is not validating its own signatures, to a version that has been modified to try to bypass other security protections.

osresearch commented 4 years ago

Wireless has something sort of similar that has signed modules for different countries. Not sure why this one has so much cryptography around it... https://wireless.wiki.kernel.org/en/developers/regulatory/crda