Hello Kurt, all,

Please assign a CVE for grub-mkconfig.

grub-mkconfig on Debian and derivatives sets mode 444 on grub.cfg 
configuration files if there are no plaintext passwords in the 
configuration file. However, the permissions are still set world
readable if the password_pbkdf2 directive includes a hashed
password.

The original bug report and proposed patch is by Francesco Poli:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=632598

Original compressed patch:

http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=safer_grub_cfg_perms.diff.gz;att=1;bug=632598

 Patch, uncompressed and inlined:

diff -ruN a/grub-mkconfig b/grub-mkconfig --- a/grub-mkconfig
2011-05-31 11:33:31.000000000 +0200 +++ b/grub-mkconfig       2011-07-03
21:15:53.000000000 +0200 @@ -293,7 +293,7 @@ esac done

-if [ "x${grub_cfg}" != "x" ] && ! grep -q "^password "
${grub_cfg}.new ; then +if [ "x${grub_cfg}" != "x" ] && ! grep -q
"^password" ${grub_cfg}.new ; then chmod 444 ${grub_cfg}.new ||
true fi