3 ms·
Part of the issue is that the threat model for grub2 changed. Before SecureBoot (grub is older than even EFI), all these vulnerabilities other than the USB one
by cesarb 6y ago
Part of the issue is that the threat model for grub2 changed.
Before SecureBoot (grub is older than even EFI), all these vulnerabilities other than the USB one would be just minor bugs, since exploiting them would gain no extra access; having access to the grub command line meant you already had full access to the system, without needing to for instance exploit buffer overflows in the command line parser.
- jolmg 6y ago> grub is older than even EFI Is EFI considered old now? Man, I haven't even started using it.
- cesarb 6y agoEFI was first released with the Itanium as its firmware (equivalent to the BIOS on PCs), and according to Wikipedia, Itanium was first released in 2001. Also according to Wikipedia, grub was first released in 1995. But what I meant is: SecureBoot builds on top of EFI, and grub predates even EFI, so grub definitely predates SecureBoot.
- jolmg 6y agoYes, I know. I was just feeling old from your expression "than even EFI", as if EFI is really old, which I guess it could be. I guess what's considered old is a bit subjective, but it doesn't seem that long ago that it started becoming mainstream, which was like in 2010, IMO.