summaryrefslogtreecommitdiffstats
path: root/meta
diff options
context:
space:
mode:
authorAlexander Kanavin <alex@linutronix.de>2025-09-02 15:03:19 +0200
committerRichard Purdie <richard.purdie@linuxfoundation.org>2025-09-15 17:57:23 +0100
commit7474ec79bd36457e94bbeb754f932fcd7f7e79d7 (patch)
treeecbb6649c247b025ed954f57d6190679f603d882 /meta
parent52cd5614270a8eca24224ee199b9fa5516db65be (diff)
downloadpoky-7474ec79bd36457e94bbeb754f932fcd7f7e79d7.tar.gz
ovmf: update 202502 -> 202508
Remove backports. (From OE-Core rev: 172587a0288cde8137c836147d261fd50072ff05) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta')
-rw-r--r--meta/recipes-core/ovmf/ovmf/0001-SecurityPkg-Don-t-define-bool-type-if-building-in-C2.patch35
-rw-r--r--meta/recipes-core/ovmf/ovmf/0001-ovmf-update-path-to-native-BaseTools.patch7
-rw-r--r--meta/recipes-core/ovmf/ovmf/0002-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch11
-rw-r--r--meta/recipes-core/ovmf/ovmf/0003-debug-prefix-map.patch26
-rw-r--r--meta/recipes-core/ovmf/ovmf/0004-reproducible.patch32
-rw-r--r--meta/recipes-core/ovmf/ovmf/CVE-2024-38797-1.patch43
-rw-r--r--meta/recipes-core/ovmf/ovmf/CVE-2024-38797-2.patch63
-rw-r--r--meta/recipes-core/ovmf/ovmf/CVE-2024-38797-3.patch99
-rw-r--r--meta/recipes-core/ovmf/ovmf/CVE-2024-38797-4.patch97
-rw-r--r--meta/recipes-core/ovmf/ovmf/CVE-2025-2295.patch56
-rw-r--r--meta/recipes-core/ovmf/ovmf_git.bb12
11 files changed, 43 insertions, 438 deletions
diff --git a/meta/recipes-core/ovmf/ovmf/0001-SecurityPkg-Don-t-define-bool-type-if-building-in-C2.patch b/meta/recipes-core/ovmf/ovmf/0001-SecurityPkg-Don-t-define-bool-type-if-building-in-C2.patch
deleted file mode 100644
index a555070ca5..0000000000
--- a/meta/recipes-core/ovmf/ovmf/0001-SecurityPkg-Don-t-define-bool-type-if-building-in-C2.patch
+++ /dev/null
@@ -1,35 +0,0 @@
1From 772fa11ac82579a8f6fa171e6b835f68af3f64be Mon Sep 17 00:00:00 2001
2From: Rebecca Cran <rebecca@bsdio.com>
3Date: Mon, 26 May 2025 08:01:39 -0600
4Subject: [PATCH] SecurityPkg: Don't define bool type if building in C23 mode
5
6In C23 bool is a built-in type, so it's not necessary to typedef
7bool in LibspdmStdBoolAlt.h.
8
9Signed-off-by: Rebecca Cran <rebecca@bsdio.com>
10
11Upstream-Status: Backport [https://github.com/tianocore/edk2/commit/772fa11ac82579a8f6fa171e6b835f68af3f64be]
12
13Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
14---
15 .../DeviceSecurity/SpdmLib/Include/hal/LibspdmStdBoolAlt.h | 3 +++
16 1 file changed, 3 insertions(+)
17
18diff --git a/SecurityPkg/DeviceSecurity/SpdmLib/Include/hal/LibspdmStdBoolAlt.h b/SecurityPkg/DeviceSecurity/SpdmLib/Include/hal/LibspdmStdBoolAlt.h
19index 08af7296d0..395ef22d43 100644
20--- a/SecurityPkg/DeviceSecurity/SpdmLib/Include/hal/LibspdmStdBoolAlt.h
21+++ b/SecurityPkg/DeviceSecurity/SpdmLib/Include/hal/LibspdmStdBoolAlt.h
22@@ -10,7 +10,10 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
23 #ifndef LIBSPDM_STDBOOL_ALT_H
24 #define LIBSPDM_STDBOOL_ALT_H
25
26+// In C23, bool is a built-in type
27+#if __STDC_VERSION__ < 202311L
28 typedef BOOLEAN bool;
29+#endif
30
31 #ifndef true
32 #define true TRUE
33--
342.34.1
35
diff --git a/meta/recipes-core/ovmf/ovmf/0001-ovmf-update-path-to-native-BaseTools.patch b/meta/recipes-core/ovmf/ovmf/0001-ovmf-update-path-to-native-BaseTools.patch
index cee5042846..890e586210 100644
--- a/meta/recipes-core/ovmf/ovmf/0001-ovmf-update-path-to-native-BaseTools.patch
+++ b/meta/recipes-core/ovmf/ovmf/0001-ovmf-update-path-to-native-BaseTools.patch
@@ -1,7 +1,7 @@
1From 61583b59620946683551f43c6110e656604a252f Mon Sep 17 00:00:00 2001 1From 0f859c6de2914cd984f8a0dd61471b91a2371bfa Mon Sep 17 00:00:00 2001
2From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com> 2From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
3Date: Thu, 9 Jun 2016 02:23:01 -0700 3Date: Thu, 9 Jun 2016 02:23:01 -0700
4Subject: [PATCH 1/4] ovmf: update path to native BaseTools 4Subject: [PATCH] ovmf: update path to native BaseTools
5 5
6BaseTools is a set of utilities to build EDK-based firmware. These utilities 6BaseTools is a set of utilities to build EDK-based firmware. These utilities
7are used during the build process. Thus, they need to be built natively. 7are used during the build process. Thus, they need to be built natively.
@@ -28,6 +28,3 @@ index 279f0d099a..285f061bf4 100755
28 echo $EDK_TOOLS_PATH 28 echo $EDK_TOOLS_PATH
29 source edksetup.sh BaseTools 29 source edksetup.sh BaseTools
30 else 30 else
31--
322.39.5
33
diff --git a/meta/recipes-core/ovmf/ovmf/0002-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch b/meta/recipes-core/ovmf/ovmf/0002-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch
index 11d97c739a..4a55528571 100644
--- a/meta/recipes-core/ovmf/ovmf/0002-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch
+++ b/meta/recipes-core/ovmf/ovmf/0002-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch
@@ -1,7 +1,7 @@
1From aacbf7c91732b9959e569e90844cf9de078b2f14 Mon Sep 17 00:00:00 2001 1From 9dbd082516fdd7100f99f0f389b8eef5ececab19 Mon Sep 17 00:00:00 2001
2From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com> 2From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
3Date: Fri, 26 Jul 2019 17:34:26 -0400 3Date: Fri, 26 Jul 2019 17:34:26 -0400
4Subject: [PATCH 2/4] BaseTools: makefile: adjust to build in under bitbake 4Subject: [PATCH] BaseTools: makefile: adjust to build in under bitbake
5 5
6Prepend the build flags with those of bitbake. This is to build 6Prepend the build flags with those of bitbake. This is to build
7using the bitbake native sysroot include and library directories. 7using the bitbake native sysroot include and library directories.
@@ -18,10 +18,10 @@ Upstream-Status: Inappropriate [needs to be converted to in-recipe fixups]
18 1 file changed, 7 insertions(+), 8 deletions(-) 18 1 file changed, 7 insertions(+), 8 deletions(-)
19 19
20diff --git a/BaseTools/Source/C/Makefiles/header.makefile b/BaseTools/Source/C/Makefiles/header.makefile 20diff --git a/BaseTools/Source/C/Makefiles/header.makefile b/BaseTools/Source/C/Makefiles/header.makefile
21index d369908a09..22c670f316 100644 21index 55a7307a5e..e36e6a8f04 100644
22--- a/BaseTools/Source/C/Makefiles/header.makefile 22--- a/BaseTools/Source/C/Makefiles/header.makefile
23+++ b/BaseTools/Source/C/Makefiles/header.makefile 23+++ b/BaseTools/Source/C/Makefiles/header.makefile
24@@ -85,35 +85,34 @@ endif 24@@ -154,35 +154,34 @@ endif
25 25
26 INCLUDE = $(TOOL_INCLUDE) -I $(MAKEROOT) -I $(MAKEROOT)/Include/Common -I $(MAKEROOT)/Include/ -I $(MAKEROOT)/Include/IndustryStandard -I $(MAKEROOT)/Common/ -I .. -I . $(ARCH_INCLUDE) 26 INCLUDE = $(TOOL_INCLUDE) -I $(MAKEROOT) -I $(MAKEROOT)/Include/Common -I $(MAKEROOT)/Include/ -I $(MAKEROOT)/Include/IndustryStandard -I $(MAKEROOT)/Common/ -I .. -I . $(ARCH_INCLUDE)
27 INCLUDE += -I $(EDK2_PATH)/MdePkg/Include 27 INCLUDE += -I $(EDK2_PATH)/MdePkg/Include
@@ -64,6 +64,3 @@ index d369908a09..22c670f316 100644
64 ifeq ($(HOST_ARCH), IA32) 64 ifeq ($(HOST_ARCH), IA32)
65 # 65 #
66 # Snow Leopard is a 32-bit and 64-bit environment. uname -m returns i386, but gcc defaults 66 # Snow Leopard is a 32-bit and 64-bit environment. uname -m returns i386, but gcc defaults
67--
682.39.5
69
diff --git a/meta/recipes-core/ovmf/ovmf/0003-debug-prefix-map.patch b/meta/recipes-core/ovmf/ovmf/0003-debug-prefix-map.patch
index 4a20548c61..1e79c23ae9 100644
--- a/meta/recipes-core/ovmf/ovmf/0003-debug-prefix-map.patch
+++ b/meta/recipes-core/ovmf/ovmf/0003-debug-prefix-map.patch
@@ -1,7 +1,7 @@
1From 96fa2a7f2f54f1e6330275b5eba07e1efdbd865b Mon Sep 17 00:00:00 2001 1From eb6db21ed0a845dce149d17acf8673d5188adea4 Mon Sep 17 00:00:00 2001
2From: Alexander Kanavin <alex.kanavin@gmail.com> 2From: Alexander Kanavin <alex.kanavin@gmail.com>
3Date: Mon, 14 Jun 2021 19:56:28 +0200 3Date: Mon, 14 Jun 2021 19:56:28 +0200
4Subject: [PATCH 3/4] debug prefix map 4Subject: [PATCH] debug prefix map
5 5
6We want to pass ${DEBUG_PREFIX_MAP} to gcc commands and also pass in 6We want to pass ${DEBUG_PREFIX_MAP} to gcc commands and also pass in
7 --debug-prefix-map to nasm (we carry a patch to nasm for this). The 7 --debug-prefix-map to nasm (we carry a patch to nasm for this). The
@@ -21,9 +21,11 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
21 BaseTools/Conf/tools_def.template | 18 +++++++++--------- 21 BaseTools/Conf/tools_def.template | 18 +++++++++---------
22 1 file changed, 9 insertions(+), 9 deletions(-) 22 1 file changed, 9 insertions(+), 9 deletions(-)
23 23
24diff --git a/BaseTools/Conf/tools_def.template b/BaseTools/Conf/tools_def.template
25index 0caa1c9001..dd86b3249d 100755
24--- a/BaseTools/Conf/tools_def.template 26--- a/BaseTools/Conf/tools_def.template
25+++ b/BaseTools/Conf/tools_def.template 27+++ b/BaseTools/Conf/tools_def.template
26@@ -920,7 +920,7 @@ NOOPT_*_*_OBJCOPY_ADDDEBUGFLAG = --a 28@@ -920,7 +920,7 @@ NOOPT_*_*_OBJCOPY_ADDDEBUGFLAG = --add-gnu-debuglink="$(DEBUG_DIR)/$(MODULE_
27 *_*_*_DTC_PATH = DEF(DTC_BIN) 29 *_*_*_DTC_PATH = DEF(DTC_BIN)
28 30
29 # All supported GCC archs except LOONGARCH64 support -mstack-protector-guard=global, so set that on everything except LOONGARCH64 31 # All supported GCC archs except LOONGARCH64 support -mstack-protector-guard=global, so set that on everything except LOONGARCH64
@@ -32,18 +34,18 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
32 DEFINE GCC_IA32_X64_CC_FLAGS = -mstack-protector-guard=global 34 DEFINE GCC_IA32_X64_CC_FLAGS = -mstack-protector-guard=global
33 DEFINE GCC_ARM_CC_FLAGS = DEF(GCC_ALL_CC_FLAGS) -mlittle-endian -mabi=aapcs -fno-short-enums -funsigned-char -ffunction-sections -fdata-sections -fomit-frame-pointer -Wno-address -mthumb -fno-pic -fno-pie -mstack-protector-guard=global 35 DEFINE GCC_ARM_CC_FLAGS = DEF(GCC_ALL_CC_FLAGS) -mlittle-endian -mabi=aapcs -fno-short-enums -funsigned-char -ffunction-sections -fdata-sections -fomit-frame-pointer -Wno-address -mthumb -fno-pic -fno-pie -mstack-protector-guard=global
34 DEFINE GCC_LOONGARCH64_CC_FLAGS = DEF(GCC_ALL_CC_FLAGS) -mabi=lp64d -fno-asynchronous-unwind-tables -Wno-address -fno-short-enums -fsigned-char -ffunction-sections -fdata-sections 36 DEFINE GCC_LOONGARCH64_CC_FLAGS = DEF(GCC_ALL_CC_FLAGS) -mabi=lp64d -fno-asynchronous-unwind-tables -Wno-address -fno-short-enums -fsigned-char -ffunction-sections -fdata-sections
35@@ -941,8 +941,8 @@ DEFINE GCC_ARM_ASLDLINK_FLAGS = DEF 37@@ -938,8 +938,8 @@ DEFINE GCC_ARM_AARCH64_ASLDLINK_FLAGS = -Wl,--defsym=PECOFF_HEADER_SIZE=0 DEF(GC
38 DEFINE GCC_ARM_ASLDLINK_FLAGS = DEF(GCC_ARM_DLINK_FLAGS) -Wl,--entry,ReferenceAcpiTable -u $(IMAGE_ENTRY_POINT) DEF(GCC_ARM_AARCH64_ASLDLINK_FLAGS)
36 DEFINE GCC_AARCH64_ASLDLINK_FLAGS = DEF(GCC_AARCH64_DLINK_FLAGS) -Wl,--entry,ReferenceAcpiTable -u $(IMAGE_ENTRY_POINT) DEF(GCC_ARM_AARCH64_ASLDLINK_FLAGS) 39 DEFINE GCC_AARCH64_ASLDLINK_FLAGS = DEF(GCC_AARCH64_DLINK_FLAGS) -Wl,--entry,ReferenceAcpiTable -u $(IMAGE_ENTRY_POINT) DEF(GCC_ARM_AARCH64_ASLDLINK_FLAGS)
37 DEFINE GCC_LOONGARCH64_ASLDLINK_FLAGS = DEF(GCC_LOONGARCH64_DLINK_FLAGS) -Wl,--entry,ReferenceAcpiTable -u $(IMAGE_ENTRY_POINT) 40 DEFINE GCC_LOONGARCH64_ASLDLINK_FLAGS = DEF(GCC_LOONGARCH64_DLINK_FLAGS) -Wl,--entry,ReferenceAcpiTable -u $(IMAGE_ENTRY_POINT)
38 DEFINE GCC_IA32_X64_DLINK_FLAGS = DEF(GCC_IA32_X64_DLINK_COMMON) --entry _$(IMAGE_ENTRY_POINT) --file-alignment 0x20 --section-alignment 0x20 -Map $(DEST_DIR_DEBUG)/$(BASE_NAME).map
39-DEFINE GCC_ASM_FLAGS = -c -x assembler -imacros AutoGen.h 41-DEFINE GCC_ASM_FLAGS = -c -x assembler -imacros AutoGen.h
40-DEFINE GCC_PP_FLAGS = -E -x assembler-with-cpp -include AutoGen.h 42-DEFINE GCC_PP_FLAGS = -E -x assembler-with-cpp -include AutoGen.h
41+DEFINE GCC_ASM_FLAGS = -c -x assembler -imacros AutoGen.h ENV(GCC_PREFIX_MAP) 43+DEFINE GCC_ASM_FLAGS = -c -x assembler -imacros AutoGen.h ENV(GCC_PREFIX_MAP)
42+DEFINE GCC_PP_FLAGS = -E -x assembler-with-cpp -include AutoGen.h ENV(GCC_PREFIX_MAP) 44+DEFINE GCC_PP_FLAGS = -E -x assembler-with-cpp -include AutoGen.h ENV(GCC_PREFIX_MAP)
43 DEFINE GCC_VFRPP_FLAGS = -x c -E -P -DVFRCOMPILE --include $(MODULE_NAME)StrDefs.h 45 DEFINE GCC_VFRPP_FLAGS = -x c -E -DVFRCOMPILE --include $(MODULE_NAME)StrDefs.h
44 DEFINE GCC_ASLPP_FLAGS = -x c -E -include AutoGen.h 46 DEFINE GCC_ASLPP_FLAGS = -x c -E -include AutoGen.h
45 DEFINE GCC_ASLCC_FLAGS = -x c 47 DEFINE GCC_ASLCC_FLAGS = -x c
46@@ -1095,7 +1095,7 @@ DEFINE GCC5_LOONGARCH64_PP_FLAGS 48@@ -1092,7 +1092,7 @@ DEFINE GCC5_LOONGARCH64_PP_FLAGS = -mabi=lp64d -march=loongarch64 DEF(
47 *_GCC48_IA32_DLINK2_FLAGS = DEF(GCC48_IA32_DLINK2_FLAGS) 49 *_GCC48_IA32_DLINK2_FLAGS = DEF(GCC48_IA32_DLINK2_FLAGS)
48 *_GCC48_IA32_RC_FLAGS = DEF(GCC_IA32_RC_FLAGS) 50 *_GCC48_IA32_RC_FLAGS = DEF(GCC_IA32_RC_FLAGS)
49 *_GCC48_IA32_OBJCOPY_FLAGS = 51 *_GCC48_IA32_OBJCOPY_FLAGS =
@@ -52,7 +54,7 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
52 54
53 DEBUG_GCC48_IA32_CC_FLAGS = DEF(GCC48_IA32_CC_FLAGS) 55 DEBUG_GCC48_IA32_CC_FLAGS = DEF(GCC48_IA32_CC_FLAGS)
54 RELEASE_GCC48_IA32_CC_FLAGS = DEF(GCC48_IA32_CC_FLAGS) -Wno-unused-but-set-variable 56 RELEASE_GCC48_IA32_CC_FLAGS = DEF(GCC48_IA32_CC_FLAGS) -Wno-unused-but-set-variable
55@@ -1123,7 +1123,7 @@ RELEASE_GCC48_IA32_CC_FLAGS = DEF( 57@@ -1120,7 +1120,7 @@ RELEASE_GCC48_IA32_CC_FLAGS = DEF(GCC48_IA32_CC_FLAGS) -Wno-unused-but-set
56 *_GCC48_X64_DLINK2_FLAGS = DEF(GCC48_X64_DLINK2_FLAGS) 58 *_GCC48_X64_DLINK2_FLAGS = DEF(GCC48_X64_DLINK2_FLAGS)
57 *_GCC48_X64_RC_FLAGS = DEF(GCC_X64_RC_FLAGS) 59 *_GCC48_X64_RC_FLAGS = DEF(GCC_X64_RC_FLAGS)
58 *_GCC48_X64_OBJCOPY_FLAGS = 60 *_GCC48_X64_OBJCOPY_FLAGS =
@@ -61,7 +63,7 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
61 63
62 DEBUG_GCC48_X64_CC_FLAGS = DEF(GCC48_X64_CC_FLAGS) 64 DEBUG_GCC48_X64_CC_FLAGS = DEF(GCC48_X64_CC_FLAGS)
63 RELEASE_GCC48_X64_CC_FLAGS = DEF(GCC48_X64_CC_FLAGS) -Wno-unused-but-set-variable 65 RELEASE_GCC48_X64_CC_FLAGS = DEF(GCC48_X64_CC_FLAGS) -Wno-unused-but-set-variable
64@@ -1232,7 +1232,7 @@ RELEASE_GCC48_AARCH64_CC_FLAGS = DEF(G 66@@ -1229,7 +1229,7 @@ RELEASE_GCC48_AARCH64_CC_FLAGS = DEF(GCC48_AARCH64_CC_FLAGS) -Wno-unused-but-s
65 *_GCC49_IA32_DLINK2_FLAGS = DEF(GCC49_IA32_DLINK2_FLAGS) 67 *_GCC49_IA32_DLINK2_FLAGS = DEF(GCC49_IA32_DLINK2_FLAGS)
66 *_GCC49_IA32_RC_FLAGS = DEF(GCC_IA32_RC_FLAGS) 68 *_GCC49_IA32_RC_FLAGS = DEF(GCC_IA32_RC_FLAGS)
67 *_GCC49_IA32_OBJCOPY_FLAGS = 69 *_GCC49_IA32_OBJCOPY_FLAGS =
@@ -70,7 +72,7 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
70 72
71 DEBUG_GCC49_IA32_CC_FLAGS = DEF(GCC49_IA32_CC_FLAGS) 73 DEBUG_GCC49_IA32_CC_FLAGS = DEF(GCC49_IA32_CC_FLAGS)
72 RELEASE_GCC49_IA32_CC_FLAGS = DEF(GCC49_IA32_CC_FLAGS) -Wno-unused-but-set-variable -Wno-unused-const-variable 74 RELEASE_GCC49_IA32_CC_FLAGS = DEF(GCC49_IA32_CC_FLAGS) -Wno-unused-but-set-variable -Wno-unused-const-variable
73@@ -1260,7 +1260,7 @@ RELEASE_GCC49_IA32_CC_FLAGS = DEF( 75@@ -1257,7 +1257,7 @@ RELEASE_GCC49_IA32_CC_FLAGS = DEF(GCC49_IA32_CC_FLAGS) -Wno-unused-but-set
74 *_GCC49_X64_DLINK2_FLAGS = DEF(GCC49_X64_DLINK2_FLAGS) 76 *_GCC49_X64_DLINK2_FLAGS = DEF(GCC49_X64_DLINK2_FLAGS)
75 *_GCC49_X64_RC_FLAGS = DEF(GCC_X64_RC_FLAGS) 77 *_GCC49_X64_RC_FLAGS = DEF(GCC_X64_RC_FLAGS)
76 *_GCC49_X64_OBJCOPY_FLAGS = 78 *_GCC49_X64_OBJCOPY_FLAGS =
@@ -79,7 +81,7 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
79 81
80 DEBUG_GCC49_X64_CC_FLAGS = DEF(GCC49_X64_CC_FLAGS) 82 DEBUG_GCC49_X64_CC_FLAGS = DEF(GCC49_X64_CC_FLAGS)
81 RELEASE_GCC49_X64_CC_FLAGS = DEF(GCC49_X64_CC_FLAGS) -Wno-unused-but-set-variable -Wno-unused-const-variable 83 RELEASE_GCC49_X64_CC_FLAGS = DEF(GCC49_X64_CC_FLAGS) -Wno-unused-but-set-variable -Wno-unused-const-variable
82@@ -1519,7 +1519,7 @@ RELEASE_GCCNOLTO_AARCH64_DLINK_XIPFLAGS 84@@ -1516,7 +1516,7 @@ RELEASE_GCCNOLTO_AARCH64_DLINK_XIPFLAGS = -z common-page-size=0x20
83 *_GCC5_IA32_DLINK2_FLAGS = DEF(GCC5_IA32_DLINK2_FLAGS) -no-pie 85 *_GCC5_IA32_DLINK2_FLAGS = DEF(GCC5_IA32_DLINK2_FLAGS) -no-pie
84 *_GCC5_IA32_RC_FLAGS = DEF(GCC_IA32_RC_FLAGS) 86 *_GCC5_IA32_RC_FLAGS = DEF(GCC_IA32_RC_FLAGS)
85 *_GCC5_IA32_OBJCOPY_FLAGS = 87 *_GCC5_IA32_OBJCOPY_FLAGS =
@@ -88,7 +90,7 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
88 90
89 DEBUG_GCC5_IA32_CC_FLAGS = DEF(GCC5_IA32_CC_FLAGS) -flto 91 DEBUG_GCC5_IA32_CC_FLAGS = DEF(GCC5_IA32_CC_FLAGS) -flto
90 DEBUG_GCC5_IA32_DLINK_FLAGS = DEF(GCC5_IA32_X64_DLINK_FLAGS) -flto -Os -Wl,-m,elf_i386,--oformat=elf32-i386 92 DEBUG_GCC5_IA32_DLINK_FLAGS = DEF(GCC5_IA32_X64_DLINK_FLAGS) -flto -Os -Wl,-m,elf_i386,--oformat=elf32-i386
91@@ -1551,7 +1551,7 @@ RELEASE_GCC5_IA32_DLINK_FLAGS = DEF(G 93@@ -1548,7 +1548,7 @@ RELEASE_GCC5_IA32_DLINK_FLAGS = DEF(GCC5_IA32_X64_DLINK_FLAGS) -flto -Os -Wl,
92 *_GCC5_X64_DLINK2_FLAGS = DEF(GCC5_X64_DLINK2_FLAGS) 94 *_GCC5_X64_DLINK2_FLAGS = DEF(GCC5_X64_DLINK2_FLAGS)
93 *_GCC5_X64_RC_FLAGS = DEF(GCC_X64_RC_FLAGS) 95 *_GCC5_X64_RC_FLAGS = DEF(GCC_X64_RC_FLAGS)
94 *_GCC5_X64_OBJCOPY_FLAGS = 96 *_GCC5_X64_OBJCOPY_FLAGS =
diff --git a/meta/recipes-core/ovmf/ovmf/0004-reproducible.patch b/meta/recipes-core/ovmf/ovmf/0004-reproducible.patch
index 0ddb86f530..73f242321e 100644
--- a/meta/recipes-core/ovmf/ovmf/0004-reproducible.patch
+++ b/meta/recipes-core/ovmf/ovmf/0004-reproducible.patch
@@ -1,7 +1,7 @@
1From fc2d3c17ff2a7b39e8d47b788eeaac5e1487cdee Mon Sep 17 00:00:00 2001 1From 0d22e07cd9cc35ede04c01d3141068db744d7677 Mon Sep 17 00:00:00 2001
2From: Alexander Kanavin <alex.kanavin@gmail.com> 2From: Alexander Kanavin <alex.kanavin@gmail.com>
3Date: Mon, 14 Jun 2021 19:57:30 +0200 3Date: Mon, 14 Jun 2021 19:57:30 +0200
4Subject: [PATCH 4/4] reproducible 4Subject: [PATCH] reproducible
5 5
6This patch fixes various things which make the build more reproducible. Some changes 6This patch fixes various things which make the build more reproducible. Some changes
7here only change intermediate artefacts but that means when you have two build trees 7here only change intermediate artefacts but that means when you have two build trees
@@ -34,9 +34,11 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
34 .../Source/Python/AutoGen/ModuleAutoGen.py | 5 +++- 34 .../Source/Python/AutoGen/ModuleAutoGen.py | 5 +++-
35 4 files changed, 24 insertions(+), 16 deletions(-) 35 4 files changed, 24 insertions(+), 16 deletions(-)
36 36
37diff --git a/BaseTools/Source/C/GenFw/Elf64Convert.c b/BaseTools/Source/C/GenFw/Elf64Convert.c
38index 18594122ea..92b5f13cf6 100644
37--- a/BaseTools/Source/C/GenFw/Elf64Convert.c 39--- a/BaseTools/Source/C/GenFw/Elf64Convert.c
38+++ b/BaseTools/Source/C/GenFw/Elf64Convert.c 40+++ b/BaseTools/Source/C/GenFw/Elf64Convert.c
39@@ -15,6 +15,8 @@ SPDX-License-Identifier: BSD-2-Clause-Pa 41@@ -15,6 +15,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
40 #include <windows.h> 42 #include <windows.h>
41 #undef RUNTIME_FUNCTION 43 #undef RUNTIME_FUNCTION
42 #include <io.h> 44 #include <io.h>
@@ -54,7 +56,7 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
54 56
55 // 57 //
56 // Add more space in the .debug data region for the DllCharacteristicsEx 58 // Add more space in the .debug data region for the DllCharacteristicsEx
57@@ -2310,7 +2312,7 @@ WriteDebug64 ( 59@@ -2322,7 +2324,7 @@ WriteDebug64 (
58 EFI_IMAGE_DEBUG_CODEVIEW_NB10_ENTRY *Nb10; 60 EFI_IMAGE_DEBUG_CODEVIEW_NB10_ENTRY *Nb10;
59 EFI_IMAGE_DEBUG_EX_DLLCHARACTERISTICS_ENTRY *DllEntry; 61 EFI_IMAGE_DEBUG_EX_DLLCHARACTERISTICS_ENTRY *DllEntry;
60 62
@@ -63,7 +65,7 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
63 65
64 NtHdr = (EFI_IMAGE_OPTIONAL_HEADER_UNION *)(mCoffFile + mNtHdrOffset); 66 NtHdr = (EFI_IMAGE_OPTIONAL_HEADER_UNION *)(mCoffFile + mNtHdrOffset);
65 DataDir = &NtHdr->Pe32Plus.OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_DEBUG]; 67 DataDir = &NtHdr->Pe32Plus.OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_DEBUG];
66@@ -2343,7 +2345,7 @@ WriteDebug64 ( 68@@ -2355,7 +2357,7 @@ WriteDebug64 (
67 69
68 Nb10 = (EFI_IMAGE_DEBUG_CODEVIEW_NB10_ENTRY*)(Dir + 1); 70 Nb10 = (EFI_IMAGE_DEBUG_CODEVIEW_NB10_ENTRY*)(Dir + 1);
69 Nb10->Signature = CODEVIEW_SIGNATURE_NB10; 71 Nb10->Signature = CODEVIEW_SIGNATURE_NB10;
@@ -72,6 +74,8 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
72 } 74 }
73 75
74 STATIC 76 STATIC
77diff --git a/BaseTools/Source/Python/AutoGen/BuildEngine.py b/BaseTools/Source/Python/AutoGen/BuildEngine.py
78index b829a2503c..afe826b78f 100644
75--- a/BaseTools/Source/Python/AutoGen/BuildEngine.py 79--- a/BaseTools/Source/Python/AutoGen/BuildEngine.py
76+++ b/BaseTools/Source/Python/AutoGen/BuildEngine.py 80+++ b/BaseTools/Source/Python/AutoGen/BuildEngine.py
77@@ -70,6 +70,9 @@ class TargetDescBlock(object): 81@@ -70,6 +70,9 @@ class TargetDescBlock(object):
@@ -84,9 +88,11 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
84 def AddInput(self, Input): 88 def AddInput(self, Input):
85 if Input not in self.Inputs: 89 if Input not in self.Inputs:
86 self.Inputs.append(Input) 90 self.Inputs.append(Input)
91diff --git a/BaseTools/Source/Python/AutoGen/GenMake.py b/BaseTools/Source/Python/AutoGen/GenMake.py
92index e5f282c4ac..27a34ef7c6 100755
87--- a/BaseTools/Source/Python/AutoGen/GenMake.py 93--- a/BaseTools/Source/Python/AutoGen/GenMake.py
88+++ b/BaseTools/Source/Python/AutoGen/GenMake.py 94+++ b/BaseTools/Source/Python/AutoGen/GenMake.py
89@@ -576,7 +576,7 @@ cleanlib: 95@@ -571,7 +571,7 @@ cleanlib:
90 os.remove(RespFileList) 96 os.remove(RespFileList)
91 97
92 # convert source files and binary files to build targets 98 # convert source files and binary files to build targets
@@ -95,7 +101,7 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
95 if len(self.ResultFileList) == 0 and len(MyAgo.SourceFileList) != 0: 101 if len(self.ResultFileList) == 0 and len(MyAgo.SourceFileList) != 0:
96 EdkLogger.error("build", AUTOGEN_ERROR, "Nothing to build", 102 EdkLogger.error("build", AUTOGEN_ERROR, "Nothing to build",
97 ExtraData="[%s]" % str(MyAgo)) 103 ExtraData="[%s]" % str(MyAgo))
98@@ -727,7 +727,7 @@ cleanlib: 104@@ -722,7 +722,7 @@ cleanlib:
99 OutputFile = '' 105 OutputFile = ''
100 DepsFileList = [] 106 DepsFileList = []
101 107
@@ -104,7 +110,7 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
104 if Cmd[2]: 110 if Cmd[2]:
105 for CopyCmd in Cmd[2]: 111 for CopyCmd in Cmd[2]:
106 Src, Dst = CopyCmd 112 Src, Dst = CopyCmd
107@@ -760,7 +760,7 @@ cleanlib: 113@@ -755,7 +755,7 @@ cleanlib:
108 self.BuildTargetList.append('\t%s' % CmdString) 114 self.BuildTargetList.append('\t%s' % CmdString)
109 115
110 self.ParseSecCmd(DepsFileList, Cmd[1]) 116 self.ParseSecCmd(DepsFileList, Cmd[1])
@@ -113,7 +119,7 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
113 self.BuildTargetList.append('%s : %s' % (self.ReplaceMacro(SecOutputFile), self.ReplaceMacro(SecDepsFile))) 119 self.BuildTargetList.append('%s : %s' % (self.ReplaceMacro(SecOutputFile), self.ReplaceMacro(SecDepsFile)))
114 self.BuildTargetList.append('\t%s' % self.ReplaceMacro(SecCmd)) 120 self.BuildTargetList.append('\t%s' % self.ReplaceMacro(SecCmd))
115 self.FfsOutputFileList = [] 121 self.FfsOutputFileList = []
116@@ -799,13 +799,13 @@ cleanlib: 122@@ -794,13 +794,13 @@ cleanlib:
117 123
118 def CommandExceedLimit(self): 124 def CommandExceedLimit(self):
119 FlagDict = { 125 FlagDict = {
@@ -134,7 +140,7 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
134 } 140 }
135 141
136 RespDict = {} 142 RespDict = {}
137@@ -1019,9 +1019,9 @@ cleanlib: 143@@ -1014,9 +1014,9 @@ cleanlib:
138 if not self.ObjTargetDict.get(T.Target.SubDir): 144 if not self.ObjTargetDict.get(T.Target.SubDir):
139 self.ObjTargetDict[T.Target.SubDir] = set() 145 self.ObjTargetDict[T.Target.SubDir] = set()
140 self.ObjTargetDict[T.Target.SubDir].add(NewFile) 146 self.ObjTargetDict[T.Target.SubDir].add(NewFile)
@@ -146,9 +152,11 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
146 # Generate related macros if needed 152 # Generate related macros if needed
147 if T.GenFileListMacro and T.FileListMacro not in self.FileListMacros: 153 if T.GenFileListMacro and T.FileListMacro not in self.FileListMacros:
148 self.FileListMacros[T.FileListMacro] = [] 154 self.FileListMacros[T.FileListMacro] = []
155diff --git a/BaseTools/Source/Python/AutoGen/ModuleAutoGen.py b/BaseTools/Source/Python/AutoGen/ModuleAutoGen.py
156index aa0b71632e..57c9cad117 100755
149--- a/BaseTools/Source/Python/AutoGen/ModuleAutoGen.py 157--- a/BaseTools/Source/Python/AutoGen/ModuleAutoGen.py
150+++ b/BaseTools/Source/Python/AutoGen/ModuleAutoGen.py 158+++ b/BaseTools/Source/Python/AutoGen/ModuleAutoGen.py
151@@ -1474,6 +1474,9 @@ class ModuleAutoGen(AutoGen): 159@@ -1429,6 +1429,9 @@ class ModuleAutoGen(AutoGen):
152 for File in Files: 160 for File in Files:
153 if File.lower().endswith('.pdb'): 161 if File.lower().endswith('.pdb'):
154 AsBuiltInfDict['binary_item'].append('DISPOSABLE|' + File) 162 AsBuiltInfDict['binary_item'].append('DISPOSABLE|' + File)
@@ -158,7 +166,7 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
158 HeaderComments = self.Module.HeaderComments 166 HeaderComments = self.Module.HeaderComments
159 StartPos = 0 167 StartPos = 0
160 for Index in range(len(HeaderComments)): 168 for Index in range(len(HeaderComments)):
161@@ -1749,7 +1752,7 @@ class ModuleAutoGen(AutoGen): 169@@ -1704,7 +1707,7 @@ class ModuleAutoGen(AutoGen):
162 if os.path.exists (self.TimeStampPath): 170 if os.path.exists (self.TimeStampPath):
163 os.remove (self.TimeStampPath) 171 os.remove (self.TimeStampPath)
164 172
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-1.patch b/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-1.patch
deleted file mode 100644
index 066dfa0ff0..0000000000
--- a/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-1.patch
+++ /dev/null
@@ -1,43 +0,0 @@
1From 2c8fb3e5164effc8a370e800fe91db7341e69116 Mon Sep 17 00:00:00 2001
2From: Doug Flick <dougflick@microsoft.com>
3Date: Mon, 7 Apr 2025 11:23:41 -0700
4Subject: [PATCH 1/4] SecurityPkg: Update SecurityFixes.yaml for CVE-2024-38797
5
6This commit updates the SecurityFixes.yaml file to include
7information about the CVE-2024-38797 vulnerability.
8
9Signed-off-by: Doug Flick <DougFlick@microsoft.com>
10
11CVE: CVE-2024-38797
12Upstream-Status: Backport [https://github.com/tianocore/edk2/pull/10928/commits/519366f542e9370bee982b1c3687ffedb5cabc21]
13Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
14---
15 SecurityPkg/SecurityFixes.yaml | 15 +++++++++++++++
16 1 file changed, 15 insertions(+)
17
18diff --git a/SecurityPkg/SecurityFixes.yaml b/SecurityPkg/SecurityFixes.yaml
19index b4006b4..06b597a 100644
20--- a/SecurityPkg/SecurityFixes.yaml
21+++ b/SecurityPkg/SecurityFixes.yaml
22@@ -40,3 +40,18 @@ CVE_2022_36764:
23 - Library\DxeTpmMeasureBootLib\DxeTpmMeasureBootLib.c
24 links:
25 - https://bugzilla.tianocore.org/show_bug.cgi?id=4118
26+CVE_2024_38797:
27+ commit-titles:
28+ - "SecurityPkg: Out of bound read in HashPeImageByType()"
29+ - "SecurityPkg: Improving HashPeImageByType () logic"
30+ - "SecurityPkg: Improving SecureBootConfigImpl:HashPeImageByType () logic"
31+ cve: CVE-2024-38797
32+ date_reported: 2024-06-04 12:00 UTC
33+ description: Out of bound read in HashPeImageByType()
34+ note:
35+ files_impacted:
36+ - SecurityPkg\Library\DxeImageVerificationLib\DxeImageVerificationLib.c
37+ - SecurityPkg\VariableAuthenticated\SecureBootConfigDxe\SecureBootConfigImpl.c
38+ links:
39+ - https://bugzilla.tianocore.org/show_bug.cgi?id=2214
40+ - https://github.com/tianocore/edk2/security/advisories/GHSA-4wjw-6xmf-44xf
41--
422.34.1
43
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-2.patch b/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-2.patch
deleted file mode 100644
index 9bf6645681..0000000000
--- a/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-2.patch
+++ /dev/null
@@ -1,63 +0,0 @@
1From 1a7be26382c4a34504875f094e15fe371d44192e Mon Sep 17 00:00:00 2001
2From: Doug Flick <dougflick@microsoft.com>
3Date: Thu, 3 Oct 2024 09:37:18 -0700
4Subject: [PATCH 2/4] SecurityPkg: Out of bound read in HashPeImageByType()
5
6In HashPeImageByType(), the hash of PE/COFF image is calculated.
7This function may get untrusted input.
8
9Inside this function, the following code verifies the loaded image has
10the correct format, by reading the second byte of the buffer.
11
12```c
13 if ((*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE) {
14 ...
15 }
16```
17
18The input image is not trusted and that may not have the second byte to
19read. So this poses an out of bound read error.
20
21With below fix we are assuring that we don't do out of bound read. i.e,
22we make sure that AuthDataSize is greater than 1.
23
24```c
25 if (AuthDataSize > 1
26 && (*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE){
27 ...
28 }
29```
30
31AuthDataSize size is verified before reading the second byte.
32So if AuthDataSize is less than 2, the second byte will not be read, and
33the out of bound read situation won't occur.
34
35Tested the patch on real platform with and without TPM connected and
36verified image is booting fine.
37
38Authored-by: Raj AlwinX Selvaraj <Alw...@intel.com>
39Signed-off-by: Doug Flick <DougFlick@microsoft.com>
40
41CVE: CVE-2024-38797
42Upstream-Status: Backport [https://github.com/tianocore/edk2/pull/10928/commits/2dcdb41b564aa3cb846644b4b1722a0b3ae5e06b]
43Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
44---
45 .../Library/DxeImageVerificationLib/DxeImageVerificationLib.c | 2 +-
46 1 file changed, 1 insertion(+), 1 deletion(-)
47
48diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
49index b05da19..2afa2c9 100644
50--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
51+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
52@@ -642,7 +642,7 @@ HashPeImageByType (
53 // This field has the fixed offset (+32) in final Authenticode ASN.1 data.
54 // Fixed offset (+32) is calculated based on two bytes of length encoding.
55 //
56- if ((*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE) {
57+ if ((AuthDataSize > 1) && ((*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE)) {
58 //
59 // Only support two bytes of Long Form of Length Encoding.
60 //
61--
622.34.1
63
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-3.patch b/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-3.patch
deleted file mode 100644
index 169c78daab..0000000000
--- a/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-3.patch
+++ /dev/null
@@ -1,99 +0,0 @@
1From 4db363db013a92937431234252fc9d84e44fc120 Mon Sep 17 00:00:00 2001
2From: Doug Flick <dougflick@microsoft.com>
3Date: Thu, 3 Oct 2024 10:16:57 -0700
4Subject: [PATCH 3/4] SecurityPkg: Improving HashPeImageByType () logic
5
6Namely:
7
8(1) The TWO_BYTE_ENCODE check is independent of Index. If it evalutes
9 to TRUE for Index==0, then it will evaluate to TRUE for all other
10 Index values as well. As a result, the (Index == HASHALG_MAX)
11 condition will fire after the loop, and we'll return
12 EFI_UNSUPPORTED.
13
14 While this is correct, functionally speaking, it is wasteful to
15 keep re-checking TWO_BYTE_ENCODE in the loop body. The check
16 should be made at the top of the function, and EFI_UNSUPPORTED
17 should be returned at once, if appropriate.
18
19(2) If the hash algorithm selected by Index has such a large OID that
20 the OID comparison cannot even be performed (because AuthDataSize
21 is not large enough for containing the OID in question, starting
22 at offset 32), then the function returns EFI_UNSUPPORTED at once.
23
24 This is bogus; this case should simply be treated as an OID
25 mismatch, and the loop should advance to the next Index value /
26 hash algorithm candidate. A remaining hash algo may have a shorter
27 OID and yield an OID match.
28
29Signed-off-by: Doug Flick <DougFlick@microsoft.com>
30
31CVE: CVE-2024-38797
32Upstream-Status: Backport [https://github.com/tianocore/edk2/pull/10928/commits/5df518ec510324f48ed1cf0376150960644b41f0]
33Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
34---
35 .../DxeImageVerificationLib.c | 37 ++++++++++---------
36 1 file changed, 19 insertions(+), 18 deletions(-)
37
38diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
39index 2afa2c9..2eca39d 100644
40--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
41+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
42@@ -618,6 +618,7 @@ Done:
43 @param[in] AuthDataSize Size of the Authenticode Signature in bytes.
44
45 @retval EFI_UNSUPPORTED Hash algorithm is not supported.
46+ @retval EFI_BAD_BUFFER_SIZE AuthData provided is invalid size.
47 @retval EFI_SUCCESS Hash successfully.
48
49 **/
50@@ -629,28 +630,28 @@ HashPeImageByType (
51 {
52 UINT8 Index;
53
54- for (Index = 0; Index < HASHALG_MAX; Index++) {
55+ //
56+ // Check the Hash algorithm in PE/COFF Authenticode.
57+ // According to PKCS#7 Definition:
58+ // SignedData ::= SEQUENCE {
59+ // version Version,
60+ // digestAlgorithms DigestAlgorithmIdentifiers,
61+ // contentInfo ContentInfo,
62+ // .... }
63+ // The DigestAlgorithmIdentifiers can be used to determine the hash algorithm in PE/COFF hashing
64+ // This field has the fixed offset (+32) in final Authenticode ASN.1 data.
65+ // Fixed offset (+32) is calculated based on two bytes of length encoding.
66+ //
67+ if ((AuthDataSize > 1) && ((*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE)) {
68 //
69- // Check the Hash algorithm in PE/COFF Authenticode.
70- // According to PKCS#7 Definition:
71- // SignedData ::= SEQUENCE {
72- // version Version,
73- // digestAlgorithms DigestAlgorithmIdentifiers,
74- // contentInfo ContentInfo,
75- // .... }
76- // The DigestAlgorithmIdentifiers can be used to determine the hash algorithm in PE/COFF hashing
77- // This field has the fixed offset (+32) in final Authenticode ASN.1 data.
78- // Fixed offset (+32) is calculated based on two bytes of length encoding.
79+ // Only support two bytes of Long Form of Length Encoding.
80 //
81- if ((AuthDataSize > 1) && ((*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE)) {
82- //
83- // Only support two bytes of Long Form of Length Encoding.
84- //
85- continue;
86- }
87+ return EFI_BAD_BUFFER_SIZE;
88+ }
89
90+ for (Index = 0; Index < HASHALG_MAX; Index++) {
91 if (AuthDataSize < 32 + mHash[Index].OidLength) {
92- return EFI_UNSUPPORTED;
93+ continue;
94 }
95
96 if (CompareMem (AuthData + 32, mHash[Index].OidValue, mHash[Index].OidLength) == 0) {
97--
982.34.1
99
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-4.patch b/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-4.patch
deleted file mode 100644
index 86bc950e7d..0000000000
--- a/meta/recipes-core/ovmf/ovmf/CVE-2024-38797-4.patch
+++ /dev/null
@@ -1,97 +0,0 @@
1From cb3342702c5c1f8a4ddbb6d503a98ed720d14eb3 Mon Sep 17 00:00:00 2001
2From: Doug Flick <dougflick@microsoft.com>
3Date: Fri, 17 Jan 2025 11:30:17 -0800
4Subject: [PATCH 4/4] SecurityPkg: Improving
5 SecureBootConfigImpl:HashPeImageByType () logic
6
7Namely:
8
9(1) The TWO_BYTE_ENCODE check is independent of Index. If it evalutes
10 to TRUE for Index==0, then it will evaluate to TRUE for all other
11 Index values as well. As a result, the (Index == HASHALG_MAX)
12 condition will fire after the loop, and we'll return
13 EFI_UNSUPPORTED.
14
15 While this is correct, functionally speaking, it is wasteful to
16 keep re-checking TWO_BYTE_ENCODE in the loop body. The check
17 should be made at the top of the function, and EFI_UNSUPPORTED
18 should be returned at once, if appropriate.
19
20(2) If the hash algorithm selected by Index has such a large OID that
21 the OID comparison cannot even be performed (because AuthDataSize
22 is not large enough for containing the OID in question, starting
23 at offset 32), then the function returns EFI_UNSUPPORTED at once.
24
25 This is bogus; this case should simply be treated as an OID
26 mismatch, and the loop should advance to the next Index value /
27 hash algorithm candidate. A remaining hash algo may have a shorter
28 OID and yield an OID match.
29
30Signed-off-by: Doug Flick <DougFlick@microsoft.com>
31
32CVE: CVE-2024-38797
33Upstream-Status: Backport [https://github.com/tianocore/edk2/pull/10928/commits/8676572908b950dd4d1f8985006011be99c0a5b6]
34Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
35---
36 .../SecureBootConfigImpl.c | 37 +++++++++++--------
37 1 file changed, 21 insertions(+), 16 deletions(-)
38
39diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
40index 6d4560c..155e755 100644
41--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
42+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
43@@ -2096,30 +2096,35 @@ HashPeImageByType (
44 {
45 UINT8 Index;
46 WIN_CERTIFICATE_EFI_PKCS *PkcsCertData;
47+ UINT32 PkcsCertSize;
48
49 PkcsCertData = (WIN_CERTIFICATE_EFI_PKCS *)(mImageBase + mSecDataDir->Offset);
50+ PkcsCertSize = mSecDataDir->SizeOfCert;
51
52- for (Index = 0; Index < HASHALG_MAX; Index++) {
53+ //
54+ // Check the Hash algorithm in PE/COFF Authenticode.
55+ // According to PKCS#7 Definition:
56+ // SignedData ::= SEQUENCE {
57+ // version Version,
58+ // digestAlgorithms DigestAlgorithmIdentifiers,
59+ // contentInfo ContentInfo,
60+ // .... }
61+ // The DigestAlgorithmIdentifiers can be used to determine the hash algorithm in PE/COFF hashing
62+ // This field has the fixed offset (+32) in final Authenticode ASN.1 data.
63+ // Fixed offset (+32) is calculated based on two bytes of length encoding.
64+ //
65+ if ((PkcsCertSize > 1) && ((*(PkcsCertData->CertData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE)) {
66 //
67- // Check the Hash algorithm in PE/COFF Authenticode.
68- // According to PKCS#7 Definition:
69- // SignedData ::= SEQUENCE {
70- // version Version,
71- // digestAlgorithms DigestAlgorithmIdentifiers,
72- // contentInfo ContentInfo,
73- // .... }
74- // The DigestAlgorithmIdentifiers can be used to determine the hash algorithm in PE/COFF hashing
75- // This field has the fixed offset (+32) in final Authenticode ASN.1 data.
76- // Fixed offset (+32) is calculated based on two bytes of length encoding.
77+ // Only support two bytes of Long Form of Length Encoding.
78 //
79- if ((*(PkcsCertData->CertData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE) {
80- //
81- // Only support two bytes of Long Form of Length Encoding.
82- //
83+ return EFI_BAD_BUFFER_SIZE;
84+ }
85+
86+ for (Index = 0; Index < HASHALG_MAX; Index++) {
87+ if (PkcsCertSize < 32 + mHash[Index].OidLength) {
88 continue;
89 }
90
91- //
92 if (CompareMem (PkcsCertData->CertData + 32, mHash[Index].OidValue, mHash[Index].OidLength) == 0) {
93 break;
94 }
95--
962.34.1
97
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2025-2295.patch b/meta/recipes-core/ovmf/ovmf/CVE-2025-2295.patch
deleted file mode 100644
index 038a3f2dbc..0000000000
--- a/meta/recipes-core/ovmf/ovmf/CVE-2025-2295.patch
+++ /dev/null
@@ -1,56 +0,0 @@
1From 4b028816b5619ede6c3720664478055e09151516 Mon Sep 17 00:00:00 2001
2From: Madhavan <madavtechy@gmail.com>
3Date: Fri, 14 Mar 2025 14:15:13 -0400
4Subject: [PATCH] NetworkPkg/IScsiDxe:Fix for Remote Memory Exposure in ISCSI
5 bz4206
6
7Used SafeUint32Add to calculate and validate OutTransferLength with
8boundary check in IScsiOnR2TRcvd to avoid integer overflow
9
10Signed-off-by: Madhavan <madavtechy@gmail.com>
11
12CVE: CVE-2025-2295
13Upstream-Status: Backport [https://github.com/tianocore/edk2/commit/17cdc512f02a2dfd1b9e24133da56fdda099abda]
14Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
15---
16 NetworkPkg/IScsiDxe/IScsiProto.c | 10 ++++++++--
17 1 file changed, 8 insertions(+), 2 deletions(-)
18
19diff --git a/NetworkPkg/IScsiDxe/IScsiProto.c b/NetworkPkg/IScsiDxe/IScsiProto.c
20index ef587649a0..fb48e6304d 100644
21--- a/NetworkPkg/IScsiDxe/IScsiProto.c
22+++ b/NetworkPkg/IScsiDxe/IScsiProto.c
23@@ -1,7 +1,7 @@
24 /** @file
25 The implementation of iSCSI protocol based on RFC3720.
26
27-Copyright (c) 2004 - 2018, Intel Corporation. All rights reserved.<BR>
28+Copyright (c) 2004 - 2025, Intel Corporation. All rights reserved.<BR>
29 SPDX-License-Identifier: BSD-2-Clause-Patent
30
31 **/
32@@ -2682,6 +2682,7 @@ IScsiOnR2TRcvd (
33 EFI_STATUS Status;
34 ISCSI_XFER_CONTEXT *XferContext;
35 UINT8 *Data;
36+ UINT32 TransferLength;
37
38 R2THdr = (ISCSI_READY_TO_TRANSFER *)NetbufGetByte (Pdu, 0, NULL);
39 if (R2THdr == NULL) {
40@@ -2712,7 +2713,12 @@ IScsiOnR2TRcvd (
41 XferContext->Offset = R2THdr->BufferOffset;
42 XferContext->DesiredLength = R2THdr->DesiredDataTransferLength;
43
44- if (((XferContext->Offset + XferContext->DesiredLength) > Packet->OutTransferLength) ||
45+ Status = SafeUint32Add (XferContext->Offset, XferContext->DesiredLength, &TransferLength);
46+ if (EFI_ERROR (Status)) {
47+ return EFI_PROTOCOL_ERROR;
48+ }
49+
50+ if ((TransferLength > Packet->OutTransferLength) ||
51 (XferContext->DesiredLength > Tcb->Conn->Session->MaxBurstLength)
52 )
53 {
54--
552.48.1
56
diff --git a/meta/recipes-core/ovmf/ovmf_git.bb b/meta/recipes-core/ovmf/ovmf_git.bb
index a8efcc2a46..577310a678 100644
--- a/meta/recipes-core/ovmf/ovmf_git.bb
+++ b/meta/recipes-core/ovmf/ovmf_git.bb
@@ -20,21 +20,15 @@ PACKAGECONFIG[tpm] = "-D TPM_ENABLE=TRUE,-D TPM_ENABLE=FALSE,,"
20#see https://src.fedoraproject.org/rpms/edk2/blob/rawhide/f/0032-Basetools-turn-off-gcc12-warning.patch 20#see https://src.fedoraproject.org/rpms/edk2/blob/rawhide/f/0032-Basetools-turn-off-gcc12-warning.patch
21BUILD_CFLAGS += "-Wno-error=stringop-overflow" 21BUILD_CFLAGS += "-Wno-error=stringop-overflow"
22 22
23SRC_URI = "gitsm://github.com/tianocore/edk2.git;branch=master;protocol=https \ 23SRC_URI = "gitsm://github.com/tianocore/edk2.git;branch=master;protocol=https;tag=${PV} \
24 file://0001-ovmf-update-path-to-native-BaseTools.patch \ 24 file://0001-ovmf-update-path-to-native-BaseTools.patch \
25 file://0002-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch \ 25 file://0002-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch \
26 file://0003-debug-prefix-map.patch \ 26 file://0003-debug-prefix-map.patch \
27 file://0004-reproducible.patch \ 27 file://0004-reproducible.patch \
28 file://CVE-2025-2295.patch \
29 file://CVE-2024-38797-1.patch \
30 file://CVE-2024-38797-2.patch \
31 file://CVE-2024-38797-3.patch \
32 file://CVE-2024-38797-4.patch \
33 file://0001-SecurityPkg-Don-t-define-bool-type-if-building-in-C2.patch \
34 " 28 "
35 29
36PV = "edk2-stable202502" 30PV = "edk2-stable202508"
37SRCREV = "fbe0805b2091393406952e84724188f8c1941837" 31SRCREV = "d46aa46c8361194521391aa581593e556c707c6e"
38UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>edk2-stable.*)" 32UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>edk2-stable.*)"
39 33
40CVE_PRODUCT = "edk2" 34CVE_PRODUCT = "edk2"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-12-31 06:15:21 +0000