gnome-software questions (how it works re: system updates)

brent

questions:
what is this update, does anyone know? "Black Lotus"? Did gnome-software go look for Lenovo Bios updates here? Or did gnome-software just detect a bios or board that needed a blanket update applied to it? why does it not tell me what manufacturer made/released this patch? or is this typical CVE stuff?

thanks for the flashlight of clarity; just don't want to hit 'update' blindly here.

EDIT: Came with WIN but I wiped it and installed Solus.. So maybe it read the boot manager history or index? No WIN bootloader is being used or visible I would think.

Axios

brent Its the firmware updater that pulls that in from where ever.
My lenovos after I installed Solus and did few updates wanted to update the dbx
I Updated them.
That been a year or so it hasnt asked for anymore

BuzzPCSOS

This was something that surfaced a while back.
A few questions; Was the computer new or secondhand and therefore of unknown pedigree? Do your updates usually display like that (Plasma user here so not sure) and if so why was there no security reference to CVE-2022-21894?
Edit: Tips on blocking Black Lotus.
Happy reading!

brent

BuzzPCSOS Was the computer new or secondhand and therefore of unknown pedigree?

thanks for the response. it was a refurb desktop I am still upgrading (so used).

Do your updates usually display like that (Plasma user here so not sure) and if so why was there no security reference to CVE-2022-21894?

beats me. I never use gnome-software, but I do check for system updates on it once a month. this is my first one. GREAT QUESTION ie missing CVE. My question is why is update so anonymous? a gnome-software thing?

Will check out Ars Technica artilcle soon, thanks.

BuzzPCSOS

brent I think that unless you have run a bit of a cleanse on the UEFI system then there could have still been Windows UEFI boot information stored in your PC. Maybe a bit of gentle probing with efibootmgr would bring something to light, although probably best to not try deleting anything just yet.

brent My question is why is update so anonymous?

Never used Gnome I'm afraid. In Plasma firmware security patches come with all the other updates through Discover for me. All I have seen so far have been BIOS updates which I have chosen to trust.
Updates via Discover are also somewhat lacking in detail, now I come to think about it, although I usually make a check at the Dell support page to make sure that there really is a BIOS update for my box before clicking the button.

brent

thanks buzz. the Ars was eye-opening. This is a Windows-Only dealio but can't possibly be if it hides in the mobo chip/firmware.
Ars didn't edit well. At the beginning of article is said can't be removed with a reinstall. at the end of article says it can be removed with a reinstall. My only other criticism of a pretty dam*ed informative article is it never said what these rootkits do except cryptic "can talk to bad guy's server" and "can execute code" which leads me to believe Firmware Rootkits have no specific agenda (?) but they just like the admin control (?).
Still a great article I urge everyone to read it. I know they mostly cannot be detected which is bad but its hard to open the door for it which is good.

Still don't explain: Whose patch is this, anyway? Why is gnome-software introducing mystery firmware updates with no author or info? edit: or maybe I don't know how to find this info, rather

BuzzPCSOS

brent Also check the other link I left at the end of my first post which is a Bleeping Computer report on NSA guidelines. It seemed to me that there was a better explanation of what the malware did and how it could compromise any software installed.
My own take on the gnome firmware update is that if it came from gnome software, after executing an instruction that you gave it to check for updates, then it is most likely fully legitimate.
Pop-ups that randomly show up after using your browser or directly after starting the PC are less likely to be trustworthy unless you can verify the source.

brent

Axios Its the firmware updater that pulls that in from where ever.
My lenovos after I installed Solus and did few updates wanted to update the dbx
I Updated them.
That been a year or so it hasnt asked for anymore

thanks. if you use the gnome-software GUI, it is very clear (solus repo or flatpak) where a package comes from. but not this.

BuzzPCSOS My own take on the gnome firmware update is that if it came from gnome software, after executing an instruction that you gave it to check for updates, then it is most likely fully legitimate.

yes, except my picture message says fwupd had not been queried yet...so it hunted for a firmware update another way?

I believe you guys that it's a harmless update but why so uncomfortably cryptic and anonymous? gnome-software developer editorial team decision perhaps? anyway, I'll leave it alone.
thank you both

Harvey

For clarity:
gnome-software and discover can make use of fwupd to get firmware updates. Not all vendors and devices support this https://fwupd.org/lvfs/devices/

If a vendor supports this feature it uses the Linux Vendor Firmware Service (LVFS) uploading the firmware themselves to be distributed via fwupd. The one current exception for this is pinephone which is done by its community.

Linux distributions are not involved in the process at all other than packaging fwupd we do not have any control over how its updates are presented such as changelog etc.

Most firmware provides little to no changelog. Here is an example for my motherboard which is not supported by fwupd/lvfs https://www.asrock.com/mb/AMD/X570%20Taichi/index.asp#BIOS

Its a UEFI update so it can only come from one location, whoever makes your PC/laptop since individual motherboard vendors do not support this service directly.

brent

Axios And thanks Harvey for the explanation on alot of these simple things.

👍️

Harvey Its a UEFI update so it can only come from one location, whoever makes your PC/laptop since individual motherboard vendors do not support this service directly.

nice! thank you

Axios

brent I agree when I first saw it wasnt sure myself left it be then month later
did a check said something like firmware update or something (going from memory).
But I agree it was not exactly clear at first.

And thanks Harvey for the explanation on alot of these simple things.

brent

Axios I agree when I first saw it wasnt sure myself left it be then month later
did a check said something like firmware update or something (going from memory).

UPDATE/BTW:
the update remained grayed out in gnome-software---I could not update it. It said it plain in that message: "If we detect a forbidden signature in your esp we won't install,"

SO:sudo fwupdmgr update, watch update install, get confirmation update installed, reboot, no problems

brent: 1
gnome-software: 0

I probably will stick with sudo eopkg and not software

Axios

brent I still have mixed feelings about gnome-software at the moment.
Just glad we still have the old stuff as I think it needs more polishing dunno..
Found (easy flatpak) been exploring it
Note: its not perfect either way it does things but its an alternative to gnome-software for flatpaks.

brent

Axios
gnome-software is ok, I just haven't broke the eopkg habit yet🙂.

This was a peculiar case. It stated in the text quite clearly (in my pic) that it would not update the ESP if it detected a bad signature. It took me a long time to figure out why it was grayed out (also in picture.)
That tells me that it (fwupd? the installer?) detected a bad sig. So I can't fault gnome software for keeping its word. although I admit I did, initially.

What is also peculiar isfwupdmgr itself had no qualms about installing a firmware update to an ESP with a 'forbidden' signature in it. It never asked me "are you sure you wanna do that?" or anything. I assumed the patch would FIX the 'forbidden signature; issue.

Why didnt gnome software figure the firmware update would fix the forbidden signature issue?
Eh probably all means nothing in the end re: firmware