3

Both Debian and Ubuntu certificates were added to the dbx EFI/UEFI firmware database because of the BootHole vulnerability, and the two major linux distros are now forced to use different private keys in order to sign software they provide. But there's no information on where the new certificates can be downloaded from. So how to get them?

2

2 Answers 2

0

Turns out that if you have an EFI binary that's signed with a particular certificate, you can extract the public part of the certificate from it:

#!/bin/sh

if [ "$1" = "" ] || [ ! -e "$1" ]
then
    echo "Usage: ${0##*/} <binary.efi>"
    exit 64 # EX_USAGE
fi

TEMPFILE=$(mktemp)
trap "rm -f $TEMPFILE" EXIT

osslsigncode extract-signature -pem "$1" "$TEMPFILE"
openssl pkcs7 -inform pem -print_certs -text -in "$TEMPFILE"

If you run this on e.g. Debian's updated grubx64.efi as scriptname /boot/efi/EFI/debian/grubx64.efi, you'll get a certificate with Subject CN=Debian Secure Boot Signer 2020 and Issuer CN=Debian Secure Boot CA in the standard output. You can pipe it into a file, and then validate it against the Debian Secure Boot CA certificate, which you can download at https://dsa.debian.org/secure-boot-ca .

Validation example:

openssl verify -verbose -CAfile debian-ca.pem debian-signer.pem
debian-signer.pem: OK

Note that Debian had to replace only their signer certificate; their old CA certificate is still valid and can be used to verify the correctness of the new signer certificate. I believe the same will apply to Canonical/Ubuntu, but I don't have their CA certificate URL at hand right now. (If someone knows/finds it, feel free to comment or edit it in!)

Source: Andreas Hunkeler's comment at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=925550

0

See Mitigating Boothole for overview:

https://ubuntu.com/blog/mitigating-boothole-theres-a-hole-in-the-boot-cve-2020-10713-and-related-vulnerabilities

See GRUB2SecureBootBypass for LiveCD repair commands:

https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass

I dare not include commands in second link here as it is beyond my scope, but think it apt to include links here to assist any likely dealing with boothole on Ubuntu.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .