kern/rescue_reader: Block the rescue mode until the CLI authentication

This further mitigates potential misuse of the CLI after the
root device has been successfully unlocked via TPM.

Fixes: CVE-2025-4382
Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

diff --git a/grub-core/kern/rescue_reader.c b/grub-core/kern/rescue_reader.c
index 4259857ba9eea45446bc40ea13c3de4ab1b88ffd..a71ada8fb7da2eae6ee7135fe234fb1755ca78b0 100644 (file)
--- a/grub-core/kern/rescue_reader.c
+++ b/grub-core/kern/rescue_reader.c
@@ -79,7 +79,7 @@ void __attribute__ ((noreturn))
 grub_rescue_run (void)
 {
   /* Stall if the CLI has been disabled */
-  if (grub_is_cli_disabled ())
+  if (grub_is_cli_disabled () || grub_is_cli_need_auth ())
     {
       grub_printf ("Rescue mode has been disabled...\n");