-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 12 Feb 2024 13:43:50 -0700 Source: edk2 Binary: ovmf ovmf-ia32 qemu-efi qemu-efi-aarch64 qemu-efi-arm Architecture: all Version: 2022.11-6+deb12u1 Distribution: bookworm-security Urgency: medium Maintainer: all Build Daemon (x86-csail-02) Changed-By: dann frazier Description: ovmf - UEFI firmware for 64-bit x86 virtual machines ovmf-ia32 - UEFI firmware for 32-bit x86 virtual machines qemu-efi - transitional dummy package qemu-efi-aarch64 - UEFI firmware for 64-bit ARM virtual machines qemu-efi-arm - UEFI firmware for 32-bit ARM virtual machines Closes: 1060408 1061256 Changes: edk2 (2022.11-6+deb12u1) bookworm-security; urgency=medium . * Cherry-pick security fixes from upstream: - Fix heap buffer overflow in Tcg2MeasureGptTable(), CVE-2022-36763 + 0001-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411.patch + 0002-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117.patch + 0003-SecurityPkg-Adding-CVE-2022-36763-to-SecurityFixes.y.patch - Fix heap buffer overflow in Tcg2MeasurePeImage(), CVE-2022-36764 + 0001-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411-2.patch + 0002-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4118.patch + 0003-SecurityPkg-Adding-CVE-2022-36764-to-SecurityFixes.y.patch - Fix build failure due to symbol collision in above patches: + 0001-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411-3.patch + 0002-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117-2.patch + 0003-SecurityPkg-Updating-SecurityFixes.yaml-after-symbol.patch - Fix integer overflow in CreateHob(), CVE-2022-36765 + 0001-UefiPayloadPkg-Hob-Integer-Overflow-in-CreateHob.patch - Fix a buffer overflow via a long server ID option in DHCPv6 client, CVE-2023-45230: + 0001-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch + 0002-NetworkPkg-Add-Unit-tests-to-CI-and-create-Host-Test.patch + 0003-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch - Fix an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message, CVE-2023-45229: + 0004-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Pa.patch + 0005-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Un.patch - Fix an out-of-bounds read when processing Neighbor Discovery Redirect messages, CVE-2023-45231: + 0006-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Patc.patch + 0007-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Unit.patch - Avoid an infinite loop when parsing unknown options in the Destination Options header of IPv6, CVE-2023-45232: + 0008-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Patc.patch + 0009-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Unit.patch - Avoid an infinite loop when parsing a PadN option in the Destination Options header of IPv6, CVE-2023-45233: + 0010-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch + 0011-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch - Fix a potential buffer overflow when processing a DNS Servers option from a DHCPv6 Advertise message, CVE-2023-45234: + 0013-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch - Fix a potential buffer overflow when handling a Server ID option from a DHCPv6 proxy Advertise message, CVE-2023-45235: + 0014-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch - Record fixes in a SecurityFix.yaml file: + 0015-NetworkPkg-Adds-a-SecurityFix.yaml-file.patch - (Closes: #1060408, #1061256) * Disable the built-in Shell when SecureBoot is enabled, CVE-2023-48733. Thanks to Mate Kukri. LP: #2040137. - Disable the built-in Shell when SecureBoot is enabled: + Disable-the-Shell-when-SecureBoot-is-enabled.patch - d/tests: Drop the boot-to-shell tests for images w/ Secure Boot active. - d/tests: Update run_cmd_check_secure_boot() to not expect shell interaction. Checksums-Sha1: bfbd10233c43d8cb1e01efd66234fb85d3dda751 11082 edk2_2022.11-6+deb12u1_all-buildd.buildinfo 65eed3e423eb2d9dcc55d5516590db89c3ad4cfe 1527268 ovmf-ia32_2022.11-6+deb12u1_all.deb d94a39fabf0ca7f565dba186597d5f64420852b9 7685064 ovmf_2022.11-6+deb12u1_all.deb 0b60170a8a6e1d48d00029c9ab2312ffe36ec4e5 2537752 qemu-efi-aarch64_2022.11-6+deb12u1_all.deb b37187a09464390d72c043a0c731d641db0d2a18 1281764 qemu-efi-arm_2022.11-6+deb12u1_all.deb a96a60175a97881a6140780c01f480a30a2b8f2b 14236 qemu-efi_2022.11-6+deb12u1_all.deb Checksums-Sha256: 167c144922329db6a308ff9e1869910397a4aab787c1eaf7c39a3a1bf1b14ff7 11082 edk2_2022.11-6+deb12u1_all-buildd.buildinfo b040bf6706da37e167f07ffff278e22561c97f8ef1ff7be195369850fee43993 1527268 ovmf-ia32_2022.11-6+deb12u1_all.deb 2eaac5ec3d21e6f02abe466d50498f4b88c2920b5362a960d3782cd1bd75c78c 7685064 ovmf_2022.11-6+deb12u1_all.deb 9b71800aad2ec7828aea3154ddceeed29d0275a1240eee79e4e71740ddeb0f17 2537752 qemu-efi-aarch64_2022.11-6+deb12u1_all.deb b3a3e7711c8616b1c1b5461eb6a1c13b9fffc2d927996b45b9b9ab0e8050496b 1281764 qemu-efi-arm_2022.11-6+deb12u1_all.deb 8e394f0dff741951cedd167b02bc3070d8354da206823833b63a7fdfd7f490c7 14236 qemu-efi_2022.11-6+deb12u1_all.deb Files: 9a7f29ac742ee7d1f0b6a2ce6cf4810e 11082 misc optional edk2_2022.11-6+deb12u1_all-buildd.buildinfo 4ea10e086ce6c6b1264bcbf92be02e77 1527268 misc optional ovmf-ia32_2022.11-6+deb12u1_all.deb 62170ed99ab0614b796f0fd2074c9e3b 7685064 misc optional ovmf_2022.11-6+deb12u1_all.deb 2f6c2c239212f7427c8e9004f262fbe7 2537752 misc optional qemu-efi-aarch64_2022.11-6+deb12u1_all.deb 331e67f0c9c8239f74f9a1f0486318dd 1281764 misc optional qemu-efi-arm_2022.11-6+deb12u1_all.deb c8267d6dc15f7325be870e9c9f951960 14236 misc optional qemu-efi_2022.11-6+deb12u1_all.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtzb3SVunlrB0F8t8ExOkVqF4GXMFAmXL9k4ACgkQExOkVqF4 GXOxEg/+NmyzgQsHGiXzbJ56gSa4iwXDZG+5xb8NexEtRLk+2PJ4aUkXKV11ky0F jrKF/La4DxWBjIIYhhFnzDuL3ZW67ReWXWcQZ4cqoDFPlXsPW/gqnU9L5thREbuY 76vaDtxMaxl0xeDclQIzCHyItLO+Gg54nvx6YUZGq1VbBGcmfHm8jJMOZN/G6ok4 Bj+ZLhCArMkqLT6KfcUX5T4QKcxZ5+fCi6q//paebENaCMKaRVaQ2L3cMeYmZ78m KI1WB7pt2EtIcS7Ek4FGEWutqytYvbZgLohNz75BKEQiVtCjAlbhXKoZBguVIFzZ M9HSLu1I0cm1rikCsYDnTBtjxfLa6Sx+qfM2coJoJLLY+78IPmH4C+Lch1VbNeHp gHLH75/u282UrSpEcmACadJMiVWA3kAwdftxgyIV0C1vLuCZAVJizXArr2/Tw21t MLRx512Xte4aNmQqoDwT8y3icm0pJ/lOh6S6VNhMPoVGznCAgsSUBtgu5bmWm+MH VJQx/1SUY+U/Z0DdUGjSSc5+0T5ZrTHG1CrCQbHpyA2S1QC2+tsJ0YT/A5evn5Sj 7ad9uaHmIfDGowRjv/RCZwXv0CduDVkXf68xkJiJPwswdicz6YhxKjRjqOK5rCFH HwLwBMhH4SDJGJ8HlOS4x7x7MdCL1p/VdiXGCd5PjiWt440Al/I= =lOtL -----END PGP SIGNATURE-----