Bug 797703 – <sys-firmware/edk2-ovmf-202105: heap overflow vulnerability (CVE-2021-28211)

• Status: CONFIRMED
• Product: Gentoo Security

[Description John Helmert III 2021-06-23 02:27:13 UTC]

CVE-2021-28211:

A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.


Patch: https://github.com/tianocore/edk2/commit/e7bd0dd26db7e56aa8ca70132d6ea916ee6f3db0
Please bump to at least 202011 (first fixed release). I'm unsure about impact
here. Maintainers, can you offer input?

[Comment 1 John Helmert III 2021-06-24 04:07:09 UTC]

CVE-2021-28210:

An unlimited recursion in DxeCore in EDK II.

Same fixed release as CVE-2021-28211 (https://bugzilla.tianocore.org/show_bug.cgi?id=1743#c33)

CVE-2021-28213:

Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks.

Bug: https://bugzilla.tianocore.org/show_bug.cgi?id=1866

Upstream bug is restricted so I can't go digging for a patch there.

[Comment 2 Larry the Git Cow 2021-06-26 22:23:58 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=944a1bda9e2a0614e3a176588bb57477813e43dd

commit 944a1bda9e2a0614e3a176588bb57477813e43dd
Author:     Matthias Maier <[e-mail]>
AuthorDate: 2021-06-26 22:16:40 +0000
Commit:     Matthias Maier <[e-mail]>
CommitDate: 2021-06-26 22:23:52 +0000

    sys-firmware/edk2-ovmf: version bump to 202105
    
    Bug: https://bugs.gentoo.org/797703
    Bug: https://bugs.gentoo.org/797232
    Bug: https://bugs.gentoo.org/798777
    Package-Manager: Portage-3.0.20, Repoman-3.0.3
    Signed-off-by: Matthias Maier <[e-mail]>

 sys-firmware/edk2-ovmf/Manifest                |   3 +
 sys-firmware/edk2-ovmf/edk2-ovmf-202105.ebuild | 173 +++++++++++++++++++++++++
 2 files changed, 176 insertions(+)

[Comment 3 Matthias Maier 2021-06-26 22:27:58 UTC]

202105 is now in tree. Let's postpone stabiliziation and cleanup for a bit to get some testing in.

[addCollapseLink(4, 1, 'Toggle comment display'); Comment 4 NATTkA bot 2021-07-29 17:21:31 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(5, 1, 'Toggle comment display'); Comment 5 NATTkA bot 2021-07-29 17:29:40 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(6, 1, 'Toggle comment display'); Comment 6 NATTkA bot 2021-07-29 17:37:39 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(7, 1, 'Toggle comment display'); Comment 7 NATTkA bot 2021-07-29 17:45:43 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(8, 1, 'Toggle comment display'); Comment 8 NATTkA bot 2021-07-29 17:53:48 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(9, 1, 'Toggle comment display'); Comment 9 NATTkA bot 2021-07-29 18:01:42 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[Comment 10 NATTkA bot 2021-07-29 18:10:03 UTC]

Package list is empty or all packages have requested keywords.

[Comment 11 Larry the Git Cow 2022-01-04 00:02:18 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dee51fb9e273c98d521b6d7083030f89d8c13ad5

commit dee51fb9e273c98d521b6d7083030f89d8c13ad5
Author:     Matthias Maier <[e-mail]>
AuthorDate: 2022-01-03 23:51:34 +0000
Commit:     Matthias Maier <[e-mail]>
CommitDate: 2022-01-04 00:02:11 +0000

    sys-firmware/edk2-ovmf: clean up vulnerable
    
    Bug: https://bugs.gentoo.org/797232
    Bug: https://bugs.gentoo.org/797703
    Package-Manager: Portage-3.0.30, Repoman-3.0.3
    Signed-off-by: Matthias Maier <[e-mail]>

 sys-firmware/edk2-ovmf/Manifest                |   3 -
 sys-firmware/edk2-ovmf/edk2-ovmf-202008.ebuild | 186 -------------------------
 2 files changed, 189 deletions(-)