* Thu Feb 12 2026 Miroslav Rezanina <mrezanin@redhat.com> - 20251114-4
- edk2-OvmfPkg-X86QemuLoadImageLib-flip-default-for-EnableL.patch [RHEL-134956] - edk2-update-openssl-rhel-submodule.patch [RHEL-147785] - edk2-update-openssl-rhel-tarball.patch [RHEL-147785] - Resolves: RHEL-134956 (CVE-2025-2296 edk2: EDK2: Improper Input Validation allows arbitrary command execution [rhel-10.2]) - Resolves: RHEL-147785 ([edk2] pick up openssl updates)
This commit is contained in:
Miroslav Rezanina
parent
80bca6e4f5
commit
3e2576e860
@ -0,0 +1,95 @@
|
||||
From e97e4a3f15ff7c0a5bc7bb1de5e664ccb0329ae6 Mon Sep 17 00:00:00 2001
|
||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Date: Wed, 10 Dec 2025 11:16:08 +0100
|
||||
Subject: [PATCH 1/3] OvmfPkg/X86QemuLoadImageLib: flip default for
|
||||
EnableLegacyLoader to false
|
||||
|
||||
RH-Author: Gerd Hoffmann <kraxel@redhat.com>
|
||||
RH-MergeRequest: 105: OvmfPkg/X86QemuLoadImageLib: flip default for EnableLegacyLoader to false
|
||||
RH-Jira: RHEL-134956
|
||||
RH-Acked-by: Luigi Leonardi <None>
|
||||
RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
|
||||
RH-Commit: [1/1] b6375a5344271fc087ce09fb3c6a42daaa0d7c9b (kraxel.rh/centos-src-edk2)
|
||||
|
||||
What happened since commit 1549bf11cc94 ("OvmfPkg/X86QemuLoadImageLib:
|
||||
make legacy loader configurable.") ?
|
||||
|
||||
First, qemu 10.0 has been released, which brings support for the -shim
|
||||
command line option so direct kernel boot with secure boot works.
|
||||
|
||||
Second, support has been added to libvirt (version v11.2.0 and newer).
|
||||
|
||||
Third, we got a bunch of linux distro releases. Latest debian, ubuntu
|
||||
and fedora releases all have new enough edk2+qemu+libvirt packages to
|
||||
support direct kernel boot with shim.efi loading and proper secure boot
|
||||
verification.
|
||||
|
||||
Lastly, the edk2 security advisory GHSA-6pp6-cm5h-86g5 and CVE-2025-2296
|
||||
have been published.
|
||||
|
||||
Time for the next step in tightening the screws: Flip the default for
|
||||
the EnableLegacyLoader config option from true to false. Also update
|
||||
the documentation accordingly.
|
||||
|
||||
The documentation for the config option is here:
|
||||
https://github.com/tianocore/edk2/blob/master/OvmfPkg/RUNTIME_CONFIG.md#user-content-security-optorgtianocoreenablelegacyloader
|
||||
|
||||
Upcoming final step, in a year or two: remove the legacy loader from the
|
||||
code base (drop X86QemuLoadImageLib, migrade all users to use
|
||||
GenericQemuLoadImageLib instead).
|
||||
|
||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||
(cherry picked from commit d2cbaefc082294eadaa30a3d5f0fa8ba264a574a)
|
||||
|
||||
Resolves: RHEL-134956
|
||||
---
|
||||
.../X86QemuLoadImageLib/X86QemuLoadImageLib.c | 2 +-
|
||||
OvmfPkg/RUNTIME_CONFIG.md | 15 +++++++++------
|
||||
2 files changed, 10 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
|
||||
index b16bdeb47f8..f98f8ab885b 100644
|
||||
--- a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
|
||||
+++ b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
|
||||
@@ -449,7 +449,7 @@ QemuLoadKernelImage (
|
||||
&Enabled
|
||||
);
|
||||
if (EFI_ERROR (RetStatus)) {
|
||||
- Enabled = TRUE;
|
||||
+ Enabled = FALSE;
|
||||
}
|
||||
|
||||
if (!Enabled) {
|
||||
diff --git a/OvmfPkg/RUNTIME_CONFIG.md b/OvmfPkg/RUNTIME_CONFIG.md
|
||||
index b75a5dacadf..57d0dd96111 100644
|
||||
--- a/OvmfPkg/RUNTIME_CONFIG.md
|
||||
+++ b/OvmfPkg/RUNTIME_CONFIG.md
|
||||
@@ -153,16 +153,19 @@ without EFI stub. If you are using kernels that old secure boot
|
||||
support is the least of your problems though ...
|
||||
|
||||
The linux kernel is typically signed by the distro secure boot keys
|
||||
-and is verified by the distro `shim.efi` binary. qemu release 10.0
|
||||
-(ETA ~ March 2025) will get support for passing the shim binary
|
||||
+and is verified by the distro `shim.efi` binary. qemu version 10.0
|
||||
+(released in April 2025) got support for passing the shim binary
|
||||
(additionally to kernel + initrd) to the firmware, so the usual secure
|
||||
boot verification can work with direct kernel load too.
|
||||
|
||||
-For now the legacy loader is enabled by default. Once the new qemu
|
||||
-release is available in most linux distros the defaut will be flipped
|
||||
-to disabled.
|
||||
+In edk2-stable202502 and newer the EnableLegacyLoader config option is
|
||||
+available and enabled by default.
|
||||
|
||||
-Usage (qemu 10.0+):
|
||||
+In edk2-stable202602 and newer the EnableLegacyLoader config option is
|
||||
+disabled by default.
|
||||
+
|
||||
+Here is the qemu command line for direct kernel boot with secure boot
|
||||
+verification:
|
||||
|
||||
```
|
||||
qemu-system-x86_64 \
|
||||
--
|
||||
2.47.3
|
||||
|
||||
17
edk2.spec
17
edk2.spec
@ -5,8 +5,8 @@ ExclusiveArch: x86_64 aarch64 riscv64
|
||||
%define GITCOMMIT 46548b1adac8
|
||||
%define TOOLCHAIN GCC
|
||||
|
||||
%define OPENSSL_VER 3.5.1
|
||||
%define OPENSSL_HASH 4cf5738ac1c163d5ce2517250321da906492c40d
|
||||
%define OPENSSL_VER 3.5.5
|
||||
%define OPENSSL_HASH c6600b817708cb4f3c6b044f28e10e9b1a1b3e2c
|
||||
|
||||
%define DBXDATE 20251016
|
||||
|
||||
@ -25,7 +25,7 @@ ExclusiveArch: x86_64 aarch64 riscv64
|
||||
|
||||
Name: edk2
|
||||
Version: %{GITDATE}
|
||||
Release: 3%{?dist}
|
||||
Release: 4%{?dist}
|
||||
Summary: UEFI firmware for 64-bit virtual machines
|
||||
License: BSD-2-Clause-Patent and Apache-2.0 and MIT
|
||||
URL: http://www.tianocore.org
|
||||
@ -100,6 +100,8 @@ Patch33: edk2-OvmfPkg-MemDebugLogPeiCoreLib-enable-for-PEIMs.patch
|
||||
Patch34: edk2-ArmVirtPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch
|
||||
# For RHEL-139470 - Enable memory debug logging support in firmware image configs
|
||||
Patch35: edk2-OvmfPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch
|
||||
# For RHEL-134956 - CVE-2025-2296 edk2: EDK2: Improper Input Validation allows arbitrary command execution [rhel-10.2]
|
||||
Patch36: edk2-OvmfPkg-X86QemuLoadImageLib-flip-default-for-EnableL.patch
|
||||
|
||||
# python3-devel and libuuid-devel are required for building tools.
|
||||
# python3-devel is also needed for varstore template generation and
|
||||
@ -477,6 +479,15 @@ install -m 0644 \
|
||||
|
||||
|
||||
%changelog
|
||||
* Thu Feb 12 2026 Miroslav Rezanina <mrezanin@redhat.com> - 20251114-4
|
||||
- edk2-OvmfPkg-X86QemuLoadImageLib-flip-default-for-EnableL.patch [RHEL-134956]
|
||||
- edk2-update-openssl-rhel-submodule.patch [RHEL-147785]
|
||||
- edk2-update-openssl-rhel-tarball.patch [RHEL-147785]
|
||||
- Resolves: RHEL-134956
|
||||
(CVE-2025-2296 edk2: EDK2: Improper Input Validation allows arbitrary command execution [rhel-10.2])
|
||||
- Resolves: RHEL-147785
|
||||
([edk2] pick up openssl updates)
|
||||
|
||||
* Mon Feb 09 2026 Miroslav Rezanina <mrezanin@redhat.com> - 20251114-3
|
||||
- edk2-OvmfPkg-AmdSev-add-memory-debug-log-support.patch [RHEL-139470]
|
||||
- edk2-OvmfPkg-MemDebugLogPeiLib-drop-duplicate-MemDebugLog.patch [RHEL-139470]
|
||||
|
||||
2
sources
2
sources
@ -2,4 +2,4 @@ SHA512 (DBXUpdate-20251016.aa64.bin) = 2af6d22d139ff58cb2d0dc0883257b6131f1bd9cc
|
||||
SHA512 (DBXUpdate-20251016.x64.bin) = 0452d2c302f702eeb2d549fd5ac4b3c3623172de9559a881bc92875590f3c5b65e301b880f5f76786e22b1af145b2aa6e58c74fef00a279950f3d6641aef484e
|
||||
SHA512 (dtc-1.7.0.tar.xz) = d3ba6902a9a2f2cdbaff55f12fca3cfe4a1ec5779074a38e3d8b88097c7abc981835957e8ce72971e10c131e05fde0b1b961768e888ff96d89e42c75edb53afb
|
||||
SHA512 (edk2-46548b1adac8.tar.xz) = 56b340943585df5efacc31af564f865664ade5eb5ff443040518263dd36784045a383970e11d3925c8c33927829e00b82efbfd77447e2fb96ad50e16064e0827
|
||||
SHA512 (openssl-rhel-4cf5738ac1c163d5ce2517250321da906492c40d.tar.xz) = 62993387684d0509d4f5b04f7369fdc9bec39aa84d9598b88971a2da46c636d0900612c51b2c9df14d9bbdd8399fb691c9d707efb177e82664408fc8b12b7c8a
|
||||
SHA512 (openssl-rhel-c6600b817708cb4f3c6b044f28e10e9b1a1b3e2c.tar.xz) = be9bb76ba1b8c3f16f4d6d15d4b4a8c57b9361dab56996b9a19bb6360996144c556c0e07827c8734b37f071e842dc0abe39d2321f09f42c47f610808f15aa0a5
|
||||
|
||||
Loading…
Reference in New Issue
Block a user