diff --git a/SOURCES/edk2-OvmfPkg-Add-Hash2DxeCrypto-to-OvmfPkg.patch b/SOURCES/edk2-OvmfPkg-Add-Hash2DxeCrypto-to-OvmfPkg.patch new file mode 100644 index 0000000..c48a286 --- /dev/null +++ b/SOURCES/edk2-OvmfPkg-Add-Hash2DxeCrypto-to-OvmfPkg.patch @@ -0,0 +1,202 @@ +From d6cdd646e7d9c4cfc78a061d66ab9ba4d2f02cf3 Mon Sep 17 00:00:00 2001 +From: Doug Flick +Date: Wed, 8 May 2024 22:56:24 -0700 +Subject: [PATCH] OvmfPkg: Add Hash2DxeCrypto to OvmfPkg + +RH-Author: Oliver Steffen +RH-MergeRequest: 81: OvmfPkg: Add Hash2DxeCrypto to OvmfPkg +RH-Jira: RHEL-53009 +RH-Acked-by: Jon Maloy +RH-Commit: [1/1] 07d3c21a816826beefe963908284cc8b5dd0b075 + +JIRA: https://issues.redhat.com/browse/RHEL-53009 +Upstream: Merged + +Upstream commit 4c4ceb2ceb80 ("NetworkPkg: SECURITY PATCH CVE-2023-45237") +broke HTTP boot in OVMF. This fixes it. + +commit cb9d71189134e78efb00759eb9649ce92bf5b29a +Author: Doug Flick +Date: Wed May 8 22:56:24 2024 -0700 + + OvmfPkg: Add Hash2DxeCrypto to OvmfPkg + + This patch adds Hash2DxeCrypto to OvmfPkg. The Hash2DxeCrypto is + used to provide the hashing protocol services. + + Cc: Ard Biesheuvel + Cc: Jiewen Yao + Cc: Gerd Hoffmann + + Signed-off-by: Doug Flick [MSFT] + Tested-by: Gerd Hoffmann + Acked-by: Gerd Hoffmann + Reviewed-by: Ard Biesheuvel + +Signed-off-by: Oliver Steffen +--- + OvmfPkg/OvmfPkgIa32.dsc | 6 +++++- + OvmfPkg/OvmfPkgIa32.fdf | 5 +++++ + OvmfPkg/OvmfPkgIa32X64.dsc | 6 +++++- + OvmfPkg/OvmfPkgIa32X64.fdf | 5 +++++ + OvmfPkg/OvmfPkgX64.dsc | 6 +++++- + OvmfPkg/OvmfPkgX64.fdf | 5 +++++ + OvmfPkg/OvmfXen.dsc | 5 +++++ + OvmfPkg/OvmfXen.fdf | 5 +++++ + 8 files changed, 40 insertions(+), 3 deletions(-) + +diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc +index f03906a9ff..47c1732409 100644 +--- a/OvmfPkg/OvmfPkgIa32.dsc ++++ b/OvmfPkg/OvmfPkgIa32.dsc +@@ -213,7 +213,6 @@ + VariablePolicyLib|MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf + VariablePolicyHelperLib|MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf + +- + # + # Network libraries + # +@@ -884,6 +883,11 @@ + MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf + MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf + ++ # ++ # Hash2 Protocol producer ++ # ++ SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf ++ + # + # Network Support + # +diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf +index 050148948c..71fb83b285 100644 +--- a/OvmfPkg/OvmfPkgIa32.fdf ++++ b/OvmfPkg/OvmfPkgIa32.fdf +@@ -300,6 +300,11 @@ INF ShellPkg/Application/Shell/Shell.inf + + INF MdeModulePkg/Logo/LogoDxe.inf + ++# ++# Hash2 Protocol producer ++# ++INF SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf ++ + # + # Network modules + # +diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc +index 81145050c3..186f783ff5 100644 +--- a/OvmfPkg/OvmfPkgIa32X64.dsc ++++ b/OvmfPkg/OvmfPkgIa32X64.dsc +@@ -217,7 +217,6 @@ + VariablePolicyLib|MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf + VariablePolicyHelperLib|MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf + +- + # + # Network libraries + # +@@ -898,6 +897,11 @@ + MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf + MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf + ++ # ++ # Hash2 Protocol producer ++ # ++ SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf ++ + # + # Network Support + # +diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf +index 3e2373f225..6762627073 100644 +--- a/OvmfPkg/OvmfPkgIa32X64.fdf ++++ b/OvmfPkg/OvmfPkgIa32X64.fdf +@@ -304,6 +304,11 @@ INF ShellPkg/Application/Shell/Shell.inf + + INF MdeModulePkg/Logo/LogoDxe.inf + ++# ++# Hash2 Protocol producer ++# ++INF SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf ++ + # + # Network modules + # +diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc +index 1cb169b447..e968ab6be2 100644 +--- a/OvmfPkg/OvmfPkgX64.dsc ++++ b/OvmfPkg/OvmfPkgX64.dsc +@@ -217,7 +217,6 @@ + VariablePolicyLib|MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf + VariablePolicyHelperLib|MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf + +- + # + # Network libraries + # +@@ -896,6 +895,11 @@ + MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf + MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf + ++ # ++ # Hash2 Protocol producer ++ # ++ SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf ++ + # + # Network Support + # +diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf +index 8ba0ca437a..95544c2bc5 100644 +--- a/OvmfPkg/OvmfPkgX64.fdf ++++ b/OvmfPkg/OvmfPkgX64.fdf +@@ -320,6 +320,11 @@ INF ShellPkg/Application/Shell/Shell.inf + + INF MdeModulePkg/Logo/LogoDxe.inf + ++# ++# Hash2 Protocol producer ++# ++INF SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf ++ + # + # Network modules + # +diff --git a/OvmfPkg/OvmfXen.dsc b/OvmfPkg/OvmfXen.dsc +index e7c36d1b80..462e57ddcc 100644 +--- a/OvmfPkg/OvmfXen.dsc ++++ b/OvmfPkg/OvmfXen.dsc +@@ -660,6 +660,11 @@ + MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf + MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf + ++ # ++ # Hash2 Protocol producer ++ # ++ SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf ++ + # + # Network Support + # +diff --git a/OvmfPkg/OvmfXen.fdf b/OvmfPkg/OvmfXen.fdf +index 8b58235559..3c64619e8e 100644 +--- a/OvmfPkg/OvmfXen.fdf ++++ b/OvmfPkg/OvmfXen.fdf +@@ -369,6 +369,11 @@ INF ShellPkg/Application/Shell/Shell.inf + + INF MdeModulePkg/Logo/LogoDxe.inf + ++# ++# Hash2 Protocol producer ++# ++INF SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf ++ + # + # Network modules + # +-- +2.45.1 + diff --git a/SPECS/edk2.spec b/SPECS/edk2.spec index e8fb9bb..aac8878 100644 --- a/SPECS/edk2.spec +++ b/SPECS/edk2.spec @@ -7,7 +7,7 @@ ExclusiveArch: x86_64 aarch64 Name: edk2 Version: %{GITDATE}git%{GITCOMMIT} -Release: 13%{?dist}.2 +Release: 13%{?dist}.3 Summary: UEFI firmware for 64-bit virtual machines Group: Applications/Emulators License: BSD-2-Clause-Patent and OpenSSL and MIT @@ -384,6 +384,8 @@ Patch114: edk2-NetworkPkg-TcpDxe-SECURITY-PATCH-CVE-2023-45236.patch # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8] # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z] Patch115: edk2-NetworkPkg-TcpDxe-Fixed-system-stuck-on-PXE-boot-flo.patch +# For RHEL-53009 - No http boot support on edk2-ovmf-20231122-6.el9_4.2 [rhel-8.10.z] +Patch116: edk2-OvmfPkg-Add-Hash2DxeCrypto-to-OvmfPkg.patch # python3-devel and libuuid-devel are required for building tools. @@ -830,6 +832,11 @@ true %endif %changelog +* Mon Aug 26 2024 Jon Maloy - 20220126gitbb1bba3d77-13.el8.3 +- edk2-OvmfPkg-Add-Hash2DxeCrypto-to-OvmfPkg.patch [RHEL-53009] +- Resolves: RHEL-53009 + (No http boot support on edk2-ovmf-20231122-6.el9_4.2 [rhel-8.10.z]) + * Wed Jul 10 2024 Jon Maloy - 20220126gitbb1bba3d77-13.el8_10.2 * Wed Jul 03 2024 Miroslav Rezanina - 20220126gitbb1bba3d77-13.el8_10.1