-
edk2 (2023.05-2ubuntu0.1) mantic; urgency=medium
* Cherry-pick security fixes from upstream:
- Fix heap buffer overflow in Tcg2MeasureGptTable(), CVE-2022-36763
+ 0001-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411.patch
+ 0002-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117.patch
+ 0003-SecurityPkg-Adding-CVE-2022-36763-to-SecurityFixes.y.patch
- Fix heap buffer overflow in Tcg2MeasurePeImage(), CVE-2022-36764
+ 0001-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411-2.patch
+ 0002-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4118.patch
+ 0003-SecurityPkg-Adding-CVE-2022-36764-to-SecurityFixes.y.patch
- Fix build failure due to symbol collision in above patches:
+ 0001-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411-3.patch
+ 0002-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117-2.patch
+ 0003-SecurityPkg-Updating-SecurityFixes.yaml-after-symbol.patch
- Fix integer overflow in CreateHob(), CVE-2022-36765
+ 0001-UefiPayloadPkg-Hob-Integer-Overflow-in-CreateHob.patch
- Fix a buffer overflow via a long server ID option in DHCPv6
client, CVE-2023-45230:
+ 0001-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch
+ 0002-NetworkPkg-Add-Unit-tests-to-CI-and-create-Host-Test.patch
+ 0003-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch
- Fix an out-of-bounds read vulnerability when processing the IA_NA
or IA_TA option in a DHCPv6 Advertise message, CVE-2023-45229:
+ 0004-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Pa.patch
+ 0005-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Un.patch
- Fix an out-of-bounds read when processing Neighbor Discovery
Redirect messages, CVE-2023-45231:
+ 0006-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Patc.patch
+ 0007-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Unit.patch
- Avoid an infinite loop when parsing unknown options in the
Destination Options header of IPv6, CVE-2023-45232:
+ 0008-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Patc.patch
+ 0009-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Unit.patch
- Avoid an infinite loop when parsing a PadN option in the
Destination Options header of IPv6, CVE-2023-45233:
+ 0010-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch
+ 0011-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch
- Fix a potential buffer overflow when processing a DNS Servers
option from a DHCPv6 Advertise message, CVE-2023-45234:
+ 0013-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch
- Fix a potential buffer overflow when handling a Server ID option
from a DHCPv6 proxy Advertise message, CVE-2023-45235:
+ 0012-MdePkg-Test-Add-gRT_GetTime-Google-Test-Mock.patch
+ 0014-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch
- Record fixes in a SecurityFix.yaml file:
+ 0015-NetworkPkg-Adds-a-SecurityFix.yaml-file.patch
* Disable the built-in Shell when SecureBoot is enabled, CVE-2023-48733.
Thanks to Mate Kukri. LP: #2040137.
- Disable the built-in Shell when SecureBoot is enabled:
+ Disable-the-Shell-when-SecureBoot-is-enabled.patch
- d/tests: Drop the boot-to-shell tests for images w/ Secure Boot active.
- d/tests: Update run_cmd_check_secure_boot() to not expect shell
interaction.
-- dann frazier <email address hidden> Mon, 12 Feb 2024 13:08:56 -0700
-
edk2 (2023.05-2) unstable; urgency=medium
* qemu-efi-aarch64/qemu-efi-arm: Disable the EFI_MEMORY_ATTRIBUTE
protocol temporarily to workaround a bug in shim until distributions
have had a chance to fix it. Closes: #1042438, LP: #2036604.
* Drop qemu-efi transitional package. Closes: #1032695.
-- dann frazier <email address hidden> Sat, 23 Sep 2023 08:35:39 -0600
-
edk2 (2023.05-1) unstable; urgency=medium
* New upstream release, based on edk2-stable202305 tag.
- Update debian/copyright, including change to BSD-2-Clause-Patent
license that happened in 2019.
- Refresh patches:
+ d/p/no-stack-protector-all-archs.diff
+ d/p/x64-baseline-abi.patch
+ d/p/Revert-ArmVirtPkg-make-EFI_LOADER_DATA-non-executabl.patch
-- dann frazier <email address hidden> Sat, 22 Jul 2023 17:17:53 -0600
-
edk2 (2023.02-2) experimental; urgency=medium
* Introduce efi-shell-* packages. Thanks to Heinrich Schuchardt of
Canonical. Closes: #837093, LP: #2006980.
* Add missing build dependency on lsb-release, thanks to José Martínez
of Google.
* Fix empty AAVMF_VARS.fd file, thanks to José Martínez of Google.
* Generate a new snakeoil certificate with a CN set. LP: #2019993.
-- dann frazier <email address hidden> Fri, 19 May 2023 17:21:36 -0600
-
edk2 (2023.02-1) experimental; urgency=medium
* New upstream release, based on edk2-stable202302 tag.
- Drop patches merged upstream:
+ d/p/0001-ArmVirtPkg-ArmPlatformLibQemu-Ensure-that-VFP-is-on-.patch
+ d/p/0002-ArmVirtPkg-ArmVirtQemu-Avoid-early-ID-map-on-Thunder.patch
- Refresh patches:
+ Revert-ArmVirtPkg-make-EFI_LOADER_DATA-non-executabl.patch
+ brotlicompress-disable.diff
+ no-stack-protector-all-archs.diff
+ x64-baseline-abi.patch
* d/binary-check updates:
- binary-check.(allow,remove): Remove files that no longer exist
upstream.
- find-binaries.py: Fix exit code when new possible binaries are found.
- Rename binary-check.allow to binary-check.ignore.
- Convert binary-check.ignore from a list of files to a list of globs.
- binary-check.ignore: Update.
* debian/rules: Correctness fix for OVMF32 build target dependency,
thanks to Glenn Washburn.
* Provide PCD configuration for SMBIOS release info. Thanks to Fiona Ebner
of Proxmox for noticing and reporting the need for this.
-- dann frazier <email address hidden> Mon, 10 Apr 2023 14:16:04 -0600
-
edk2 (2022.11-6) unstable; urgency=medium
* autopkgtest: Set an encoding in pexpect.spawn() calls so we can
log to sys.stdout instead of using sys.stdout.buffer as a workaround.
* autopkgtest: Also fail secure boot tests if QEMU process exits
non-zero.
* autopkgtest: Output test runtimes to help debug timeout issues like
the one fixed in the last upload.
* autopkgtest: Bump test timeout from 60s to 120s. We've hit the
60s timeout on Ubuntu infrastructure with QEMU 7.2.
-- dann frazier <email address hidden> Sun, 05 Mar 2023 13:36:02 -0700
