There have been reports yesterday about a new security vulnerablity:
- Lucian Constantin (2015-12-16). Vulnerability in popular bootloader puts locked-down Linux computers at risk. CSO Online.
- Patrick Allan (2015-12-16). You Can Break Into a Linux System by Pressing Backspace 28 Times. Here’s How to Fix It. Life Hacker.
- Swati Khandelwal (2015-12-16). You can Hack into a Linux Computer just by pressing 'Backspace' 28 times.. The Hacker News.
The news reports all say things like the vulnerability can "allow a hacker to install malware on a locked-down Linux system", can "bypass all security of a locked-down Linux machine", and can "bypass password protection on your computer". The actual vulnerability itself is CVE-2015-8370, and has been written up by one of its discoverers:
- Hector Marco and Ismael Ripoll (2015-12-14). Back to 28: Grub2 Authentication 0-Day. CVE-2015-8370.
Whilst the news reports are hyperbolic, talking of vulnerabilities in Linux, the report by Marco and Ripoll is very technical for the non-programmer to absorb, descending into colourized source code or GRUB2 and 40-character-long strings of numbers and letters within the first page.
I'm just an ordinary "security guy". I keep my applications and operating systems up to date with security patches. So, without the hyperbole from the news reports, and without baffling me with source code and hexddumps:
- Is there any immediate action that I should take? Is there any immediate action that I can take?
- What is the risk to my personal systems at home?
- What is the risk to my servers at work? If someone had IPKVM or ILO access, for example, could this be exploited?