From: Maxim Suhanov <dfirblog@gmail.com>
Date: Fri, 28 Feb 2025 14:00:53 +0000 (+0300)
Subject: kern/rescue_reader: Block the rescue mode until the CLI authentication
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c448f511e74cb7c776b314fcb7943f98d3f22b6d;p=thirdparty%2Fgrub.git

kern/rescue_reader: Block the rescue mode until the CLI authentication

This further mitigates potential misuse of the CLI after the
root device has been successfully unlocked via TPM.

Fixes: CVE-2025-4382

Signed-off-by: Maxim Suhanov <dfirblog@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---

diff --git a/grub-core/kern/rescue_reader.c b/grub-core/kern/rescue_reader.c
index 4259857ba..a71ada8fb 100644
--- a/grub-core/kern/rescue_reader.c
+++ b/grub-core/kern/rescue_reader.c
@@ -79,7 +79,7 @@ void __attribute__ ((noreturn))
 grub_rescue_run (void)
 {
   /* Stall if the CLI has been disabled */
-  if (grub_is_cli_disabled ())
+  if (grub_is_cli_disabled () || grub_is_cli_need_auth ())
     {
       grub_printf ("Rescue mode has been disabled...\n");