Well, some Linux users.

Story: Zero-Day GRUB2 Vulnerability Hits Linux Users, Patch Available for Ubuntu, RHELTotal Replies: 4
Author Content
jdixon

Dec 16, 2015
9:38 AM EDT
It appears that the author doesn't know that not every distribution defaults to using Grub.
penguinist

Dec 16, 2015
10:24 AM EDT
That's true, and also notice that this issue applies only to the case where physical access is available.

Physical access has always meant access regardless of the OS running on that machine as long as the bios is set to permit booting from a live disk. I recently set up dual boot on 25 classroom systems completely without the need to log into an administrator account on the Windows side and had full access to the contents of the Windows file system while doing it. So Windows systems, Linux systems and Mac systems are all vulnerable whenever physical access is available.

We should all remember to keep our systems physically secure, and if a system is physically secure then this grub2 issue is irrelevant.

Aside from that, this is FOSS and the bug will be fixed immediately.

You can be on your way, these are not the droids you're looking for...
jdixon

Dec 16, 2015
4:08 PM EDT
> Physical access has always meant access regardless of the OS running on that machine as long as the bios is set to permit booting from a live disk.

And if you can enter the bios and change the settings, even then.

As others have stated before, if you don't have physical security, you don't have security.
cybertao

Dec 17, 2015
3:02 AM EDT
By dropping into GRUB's command prompt, you can boot a variety of things from a variety of locations. On a system configured to only boot the GRUB device it is possible to boot something not already in the menu.

Although, in all the years I've been using GRUB Legacy/2 (reading documentation, manual configuration, various OS installations, even compiling an EFI version to boot LFS), I never knew password protection was available. I've never encountered it in the wild.
mbaehrlxer

Dec 19, 2015
4:22 AM EDT
Quoting:this issue applies only to the case where physical access is available
and where grub is actually protected by a password.

Quoting:I never knew password protection was available. I've never encountered it in the wild


it's like worrying about breaking the lock on an open door.

greetings, eMBee.

Posting in this forum is limited to members of the group: [ForumMods, SITEADMINS, MEMBERS.]

Becoming a member of LXer is easy and free. Join Us!