Fedora CoreOS supports setting a GRUB bootloader password using a Butane config. When this feature is enabled, GRUB requires a password to access the GRUB command-line, modify kernel command-line arguments, or boot non-default OSTree deployments. Recent Fedora CoreOS releases have a misconfiguration which allows booting non-default OSTree deployments without entering a password. This allows someone with access to the GRUB menu to boot into an older version of Fedora CoreOS, reverting any security fixes that have recently been applied to the machine. A password is still required to modify kernel command-line arguments and to access the GRUB command line.
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
| Link | Tags |
|---|---|
| https://github.com/coreos/fedora-coreos-tracker/issues/1333 | third party advisory issue tracking |
| https://lists.fedoraproject.org/archives/list/coreos-status@lists.fedoraproject.org/thread/NHUCNH5Y4UH5DPUCXISYXXVA563TLFEJ/ | vendor advisory mailing list release notes |
| https://docs.fedoraproject.org/en-US/fedora-coreos/grub-password/ | vendor advisory related |