Home page logo

oss-sec logo oss-sec mailing list archives

Re: Plug-and-wipe and Secure Boot semantics
From: Greg KH <greg () kroah com>
Date: Wed, 19 Dec 2012 08:34:59 -0800

On Wed, Dec 19, 2012 at 10:20:12AM +0100, Florian Weimer wrote:
On 12/19/2012 06:39 AM, Greg KH wrote:
The Fedora 18 TC3 installer boots on the machine mentioned above, in
the factory default configuration.  Previous installer versions
showed a Secure Boot error message.  I've run into an installer bug,

Previous versions of Fedora 18 betas didn't have a valid signed
bootloader to allow anything to be installed, are you sure it's all
properly built now?

Yes, or the UEFI implementation on the box is buggy.  It could not
boot the installer before, but now it can.

But, more on-topic, how does UEFI secure boot have anything to do with
this mailing list?

Aren't vendors basing their implementation on the open-source code
from Intel?  Or are you referring to the fact that Secure Boot has
little to do with security?

We don't know what vendors are basing their UEFI bios implementation on
the open source version, I know there is at least one UEFI bios that is
not based on the open source version, or so it is reported (the BSD
license of Tianocore means that we will never really know.)

Determining what machine is running what bios from what company that was
based on what version of the open source UEFI implementation is going to
be a huge problem in the long run and something that I sure don't want
to have to track.

There have been reported bugs in the Tianocore in the past, I don't
think they were "security" issues in and of themselves, should we be
reporting them here to get CVE numbers if they are?


greg k-h

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]