Summary: | <sys-firmware/edk2-ovmf-202105: heap overflow vulnerability (CVE-2021-28211) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | John Helmert III <ajak> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | CONFIRMED --- | ||
Severity: | normal | CC: | tamiko, virtualization |
Priority: | Normal | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | https://bugzilla.tianocore.org/show_bug.cgi?id=1816 | ||
Whiteboard: | B? [glsa?] | ||
Package list: | Runtime testing required: | --- | |
Bug Depends on: | 797232 | ||
Bug Blocks: |
Description
John Helmert III
![]() ![]() ![]() ![]() CVE-2021-28210: An unlimited recursion in DxeCore in EDK II. Same fixed release as CVE-2021-28211 (https://bugzilla.tianocore.org/show_bug.cgi?id=1743#c33) CVE-2021-28213: Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks. Bug: https://bugzilla.tianocore.org/show_bug.cgi?id=1866 Upstream bug is restricted so I can't go digging for a patch there. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=944a1bda9e2a0614e3a176588bb57477813e43dd commit 944a1bda9e2a0614e3a176588bb57477813e43dd Author: Matthias Maier <tamiko@gentoo.org> AuthorDate: 2021-06-26 22:16:40 +0000 Commit: Matthias Maier <tamiko@gentoo.org> CommitDate: 2021-06-26 22:23:52 +0000 sys-firmware/edk2-ovmf: version bump to 202105 Bug: https://bugs.gentoo.org/797703 Bug: https://bugs.gentoo.org/797232 Bug: https://bugs.gentoo.org/798777 Package-Manager: Portage-3.0.20, Repoman-3.0.3 Signed-off-by: Matthias Maier <tamiko@gentoo.org> sys-firmware/edk2-ovmf/Manifest | 3 + sys-firmware/edk2-ovmf/edk2-ovmf-202105.ebuild | 173 +++++++++++++++++++++++++ 2 files changed, 176 insertions(+) 202105 is now in tree. Let's postpone stabiliziation and cleanup for a bit to get some testing in. Package list is empty or all packages have requested keywords. Package list is empty or all packages have requested keywords. Package list is empty or all packages have requested keywords. Package list is empty or all packages have requested keywords. Package list is empty or all packages have requested keywords. Package list is empty or all packages have requested keywords. Package list is empty or all packages have requested keywords. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dee51fb9e273c98d521b6d7083030f89d8c13ad5 commit dee51fb9e273c98d521b6d7083030f89d8c13ad5 Author: Matthias Maier <tamiko@gentoo.org> AuthorDate: 2022-01-03 23:51:34 +0000 Commit: Matthias Maier <tamiko@gentoo.org> CommitDate: 2022-01-04 00:02:11 +0000 sys-firmware/edk2-ovmf: clean up vulnerable Bug: https://bugs.gentoo.org/797232 Bug: https://bugs.gentoo.org/797703 Package-Manager: Portage-3.0.30, Repoman-3.0.3 Signed-off-by: Matthias Maier <tamiko@gentoo.org> sys-firmware/edk2-ovmf/Manifest | 3 - sys-firmware/edk2-ovmf/edk2-ovmf-202008.ebuild | 186 ------------------------- 2 files changed, 189 deletions(-) |