CVE-2015-7837: Medium severity red hat enterprise linux vulnerability
A vulnerability was found in kexec, allowing the attacker to bypass the security mechanism of securelevel/secureboot combination.
When the kernel was booted with UEFI Secure Boot enabled, securelevel is set. If kexec (either through crash or admin action) is then used to load the same kernel, after reboot securelevel is disabled. In this state, the system is missing the protections provided by securelevel, for example kexec may be used to load an unsigned kernel via the legacy system call kexecload. In the securelevel patchset, the state of UEFI Secure Boot is queried in the EFI stub, and sets a bootparams flag to indicate the state of UEFI Secure Boot. This flag is then used in setuparch() to determine the correct state of securelevel. If the kernel is not booted via the EFI stub, securelevel is not set even if UEFI Secure Boot is enabled.
Patch can be found in product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1243998#c3
Upstream patch:
https://github.com/mjg59/linux/commit/4b2b64d5a6ebc84214755ebccd599baef7c1b798
CVE assignment:
http://seclists.org/oss-sec/2015/q4/85
Other sources
The Linux kernel, as used in Red Hat Enterprise Linux 7, kernel-rt, and Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended securelevel/secureboot restrictions by leveraging improper handling of secureboot flag across kexec reboot.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2015-7837?
CVE-2015-7837 is a vulnerability in the Linux kernel that allows local users to bypass secureboot restrictions.
Which Linux distributions are affected by CVE-2015-7837?
Red Hat Enterprise Linux 7, kernel-rt, and Enterprise MRG 2 are affected by CVE-2015-7837.
How can the securelevel/secureboot restrictions be bypassed in CVE-2015-7837?
The securelevel/secureboot restrictions can be bypassed in CVE-2015-7837 by leveraging improper handling of the secure_boot flag across kexec reboot.
What is the severity of CVE-2015-7837?
CVE-2015-7837 has a low severity rating.
How can I fix CVE-2015-7837?
To fix CVE-2015-7837, update the Linux kernel to a patched version provided by the respective Linux distribution.