diff --git a/edk2-OvmfPkg-X86QemuLoadImageLib-flip-default-for-EnableL.patch b/edk2-OvmfPkg-X86QemuLoadImageLib-flip-default-for-EnableL.patch new file mode 100644 index 0000000..a89ba43 --- /dev/null +++ b/edk2-OvmfPkg-X86QemuLoadImageLib-flip-default-for-EnableL.patch @@ -0,0 +1,95 @@ +From e97e4a3f15ff7c0a5bc7bb1de5e664ccb0329ae6 Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Wed, 10 Dec 2025 11:16:08 +0100 +Subject: [PATCH 1/3] OvmfPkg/X86QemuLoadImageLib: flip default for + EnableLegacyLoader to false + +RH-Author: Gerd Hoffmann +RH-MergeRequest: 105: OvmfPkg/X86QemuLoadImageLib: flip default for EnableLegacyLoader to false +RH-Jira: RHEL-134956 +RH-Acked-by: Luigi Leonardi +RH-Acked-by: Oliver Steffen +RH-Commit: [1/1] b6375a5344271fc087ce09fb3c6a42daaa0d7c9b (kraxel.rh/centos-src-edk2) + +What happened since commit 1549bf11cc94 ("OvmfPkg/X86QemuLoadImageLib: +make legacy loader configurable.") ? + +First, qemu 10.0 has been released, which brings support for the -shim +command line option so direct kernel boot with secure boot works. + +Second, support has been added to libvirt (version v11.2.0 and newer). + +Third, we got a bunch of linux distro releases. Latest debian, ubuntu +and fedora releases all have new enough edk2+qemu+libvirt packages to +support direct kernel boot with shim.efi loading and proper secure boot +verification. + +Lastly, the edk2 security advisory GHSA-6pp6-cm5h-86g5 and CVE-2025-2296 +have been published. + +Time for the next step in tightening the screws: Flip the default for +the EnableLegacyLoader config option from true to false. Also update +the documentation accordingly. + +The documentation for the config option is here: +https://github.com/tianocore/edk2/blob/master/OvmfPkg/RUNTIME_CONFIG.md#user-content-security-optorgtianocoreenablelegacyloader + +Upcoming final step, in a year or two: remove the legacy loader from the +code base (drop X86QemuLoadImageLib, migrade all users to use +GenericQemuLoadImageLib instead). + +Signed-off-by: Gerd Hoffmann +(cherry picked from commit d2cbaefc082294eadaa30a3d5f0fa8ba264a574a) + +Resolves: RHEL-134956 +--- + .../X86QemuLoadImageLib/X86QemuLoadImageLib.c | 2 +- + OvmfPkg/RUNTIME_CONFIG.md | 15 +++++++++------ + 2 files changed, 10 insertions(+), 7 deletions(-) + +diff --git a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c +index b16bdeb47f8..f98f8ab885b 100644 +--- a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c ++++ b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c +@@ -449,7 +449,7 @@ QemuLoadKernelImage ( + &Enabled + ); + if (EFI_ERROR (RetStatus)) { +- Enabled = TRUE; ++ Enabled = FALSE; + } + + if (!Enabled) { +diff --git a/OvmfPkg/RUNTIME_CONFIG.md b/OvmfPkg/RUNTIME_CONFIG.md +index b75a5dacadf..57d0dd96111 100644 +--- a/OvmfPkg/RUNTIME_CONFIG.md ++++ b/OvmfPkg/RUNTIME_CONFIG.md +@@ -153,16 +153,19 @@ without EFI stub. If you are using kernels that old secure boot + support is the least of your problems though ... + + The linux kernel is typically signed by the distro secure boot keys +-and is verified by the distro `shim.efi` binary. qemu release 10.0 +-(ETA ~ March 2025) will get support for passing the shim binary ++and is verified by the distro `shim.efi` binary. qemu version 10.0 ++(released in April 2025) got support for passing the shim binary + (additionally to kernel + initrd) to the firmware, so the usual secure + boot verification can work with direct kernel load too. + +-For now the legacy loader is enabled by default. Once the new qemu +-release is available in most linux distros the defaut will be flipped +-to disabled. ++In edk2-stable202502 and newer the EnableLegacyLoader config option is ++available and enabled by default. + +-Usage (qemu 10.0+): ++In edk2-stable202602 and newer the EnableLegacyLoader config option is ++disabled by default. ++ ++Here is the qemu command line for direct kernel boot with secure boot ++verification: + + ``` + qemu-system-x86_64 \ +-- +2.47.3 + diff --git a/edk2.spec b/edk2.spec index f5acdbf..ecaed6b 100644 --- a/edk2.spec +++ b/edk2.spec @@ -5,8 +5,8 @@ ExclusiveArch: x86_64 aarch64 riscv64 %define GITCOMMIT 46548b1adac8 %define TOOLCHAIN GCC -%define OPENSSL_VER 3.5.1 -%define OPENSSL_HASH 4cf5738ac1c163d5ce2517250321da906492c40d +%define OPENSSL_VER 3.5.5 +%define OPENSSL_HASH c6600b817708cb4f3c6b044f28e10e9b1a1b3e2c %define DBXDATE 20251016 @@ -25,7 +25,7 @@ ExclusiveArch: x86_64 aarch64 riscv64 Name: edk2 Version: %{GITDATE} -Release: 3%{?dist} +Release: 4%{?dist} Summary: UEFI firmware for 64-bit virtual machines License: BSD-2-Clause-Patent and Apache-2.0 and MIT URL: http://www.tianocore.org @@ -100,6 +100,8 @@ Patch33: edk2-OvmfPkg-MemDebugLogPeiCoreLib-enable-for-PEIMs.patch Patch34: edk2-ArmVirtPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch # For RHEL-139470 - Enable memory debug logging support in firmware image configs Patch35: edk2-OvmfPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch +# For RHEL-134956 - CVE-2025-2296 edk2: EDK2: Improper Input Validation allows arbitrary command execution [rhel-10.2] +Patch36: edk2-OvmfPkg-X86QemuLoadImageLib-flip-default-for-EnableL.patch # python3-devel and libuuid-devel are required for building tools. # python3-devel is also needed for varstore template generation and @@ -477,6 +479,15 @@ install -m 0644 \ %changelog +* Thu Feb 12 2026 Miroslav Rezanina - 20251114-4 +- edk2-OvmfPkg-X86QemuLoadImageLib-flip-default-for-EnableL.patch [RHEL-134956] +- edk2-update-openssl-rhel-submodule.patch [RHEL-147785] +- edk2-update-openssl-rhel-tarball.patch [RHEL-147785] +- Resolves: RHEL-134956 + (CVE-2025-2296 edk2: EDK2: Improper Input Validation allows arbitrary command execution [rhel-10.2]) +- Resolves: RHEL-147785 + ([edk2] pick up openssl updates) + * Mon Feb 09 2026 Miroslav Rezanina - 20251114-3 - edk2-OvmfPkg-AmdSev-add-memory-debug-log-support.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiLib-drop-duplicate-MemDebugLog.patch [RHEL-139470] diff --git a/sources b/sources index b72991e..6cb81a4 100644 --- a/sources +++ b/sources @@ -2,4 +2,4 @@ SHA512 (DBXUpdate-20251016.aa64.bin) = 2af6d22d139ff58cb2d0dc0883257b6131f1bd9cc SHA512 (DBXUpdate-20251016.x64.bin) = 0452d2c302f702eeb2d549fd5ac4b3c3623172de9559a881bc92875590f3c5b65e301b880f5f76786e22b1af145b2aa6e58c74fef00a279950f3d6641aef484e SHA512 (dtc-1.7.0.tar.xz) = d3ba6902a9a2f2cdbaff55f12fca3cfe4a1ec5779074a38e3d8b88097c7abc981835957e8ce72971e10c131e05fde0b1b961768e888ff96d89e42c75edb53afb SHA512 (edk2-46548b1adac8.tar.xz) = 56b340943585df5efacc31af564f865664ade5eb5ff443040518263dd36784045a383970e11d3925c8c33927829e00b82efbfd77447e2fb96ad50e16064e0827 -SHA512 (openssl-rhel-4cf5738ac1c163d5ce2517250321da906492c40d.tar.xz) = 62993387684d0509d4f5b04f7369fdc9bec39aa84d9598b88971a2da46c636d0900612c51b2c9df14d9bbdd8399fb691c9d707efb177e82664408fc8b12b7c8a +SHA512 (openssl-rhel-c6600b817708cb4f3c6b044f28e10e9b1a1b3e2c.tar.xz) = be9bb76ba1b8c3f16f4d6d15d4b4a8c57b9361dab56996b9a19bb6360996144c556c0e07827c8734b37f071e842dc0abe39d2321f09f42c47f610808f15aa0a5