CVE-2022-1665

A flaw was found in the Linux kernel, where a set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture were signed with Red Hat's production secure boot keys. This issue allows kernel versions targeted for testing to eventually boot in PowerPC environments with the Secure Boot feature enabled. An attacker needs high privilege to install the non-production kernel packages in the target machine and make it the default boot option on grub2.

The RHEL 8 kernel SRPM has a means to build a blacklist of sha256 hashes of bad kernels that can be added to. This should prevent kexec from booting them. If it's the bootloader booting them, then that's before the kernel is even loaded and isn't a kernel problem. Such hashes may also be added to the blacklist table of a UEFI BIOS.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.