Description
Fedora CoreOS supports setting a GRUB bootloader password using a Butane config. When this feature is enabled, GRUB requires a password to access the GRUB command-line, modify kernel command-line arguments, or boot non-default OSTree deployments. Recent Fedora CoreOS releases have a misconfiguration which allows booting non-default OSTree deployments without entering a password. This allows someone with access to the GRUB menu to boot into an older version of Fedora CoreOS, reverting any security fixes that have recently been applied to the machine. A password is still required to modify kernel command-line arguments and to access the GRUB command line.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Fedora Project CoreOS
Default version status: unaffected
testing 36.20220906.2.0 and later to < testing 36.20221030.2.0affectednext 36.20220906.1.0 and later to < next 37.20221031.1.0affectedstable 36.20220820.3.0 and later to < stable 36.20221014.3.0affected