a0d9f2d87e
- edk2-SecurityPkg-Change-use-of-EFI_D_-to-DEBUG_.patch [RHEL-21154 RHEL-21156] - edk2-SecurityPkg-Change-OPTIONAL-keyword-usage-style.patch [RHEL-21154 RHEL-21156] - edk2-MdePkg-Introduce-CcMeasurementProtocol-for-CC-Guest-.patch [RHEL-21154 RHEL-21156] - edk2-SecurityPkg-Support-CcMeasurementProtocol-in-DxeTpm2.patch [RHEL-21154 RHEL-21156] - edk2-SecurityPkg-Support-CcMeasurementProtocol-in-DxeTpmM.patch [RHEL-21154 RHEL-21156] - edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411.patch [RHEL-21154 RHEL-21156] - edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117.patch [RHEL-21154 RHEL-21156] - edk2-SecurityPkg-Adding-CVE-2022-36763-to-SecurityFixes.y.patch [RHEL-21154 RHEL-21156] - edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-418.patch [RHEL-21154 RHEL-21156] - edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4118.patch [RHEL-21154 RHEL-21156] - edk2-SecurityPkg-DxeTpm2MeasureBootLib-SEC-PATCH-4118-2.patch [RHEL-21154 RHEL-21156] - edk2-SecurityPkg-DxeTpmMeasureBootLib-SEC-PATCH-4117-2.patch [RHEL-21154 RHEL-21156] - edk2-SecurityPkg-Updating-SecurityFixes.yaml-after-symbol.patch [RHEL-21154 RHEL-21156] - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch [RHEL-21840 RHEL-21842] - edk2-NetworkPkg-Add-Unit-tests-to-CI-and-create-Host-Test.patch [RHEL-21840 RHEL-21842] - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch [RHEL-21840 RHEL-21842] - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Pa.patch [RHEL-21840 RHEL-21842] - Resolves: RHEL-21154 (CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-8]) - Resolves: RHEL-21156 (CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-8]) - Resolves: RHEL-21840 (CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]) - Resolves: RHEL-21842 (CVE-2023-45230 edk2: Buffer overflow in the DHCPv6 client via a long Server ID option [rhel-8])
69 lines
2.4 KiB
Diff
69 lines
2.4 KiB
Diff
From 2794a967f43f2bbdfcd2cb5197ac8cad4b13c3de Mon Sep 17 00:00:00 2001
|
|
From: Jon Maloy <jmaloy@redhat.com>
|
|
Date: Wed, 17 Jan 2024 12:20:52 -0500
|
|
Subject: [PATCH 08/17] SecurityPkg: Adding CVE 2022-36763 to
|
|
SecurityFixes.yaml
|
|
|
|
RH-Author: Jon Maloy <jmaloy@redhat.com>
|
|
RH-MergeRequest: 44: edk2: heap buffer overflow in Tcg2MeasureGptTable()
|
|
RH-Jira: RHEL-21154 RHEL-21156
|
|
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
|
|
RH-Commit: [8/13] 74117caf760e403566f6511332b2c0f41483f28c (jmaloy/jons_fork)
|
|
|
|
JIRA: https://issues.redhat.com/browse/RHEL-21154
|
|
Upstream: Merged
|
|
CVE: CVE-2022-36763
|
|
|
|
commit 1ddcb9fc6b4164e882687b031e8beacfcf7df29e
|
|
Author: Douglas Flick [MSFT] <doug.edk2@gmail.com>
|
|
Date: Fri Jan 12 02:16:03 2024 +0800
|
|
|
|
SecurityPkg: : Adding CVE 2022-36763 to SecurityFixes.yaml
|
|
|
|
This creates / adds a security file that tracks the security fixes
|
|
found in this package and can be used to find the fixes that were
|
|
applied.
|
|
|
|
Cc: Jiewen Yao <jiewen.yao@intel.com>
|
|
|
|
Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
|
|
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
|
|
|
|
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
|
|
---
|
|
SecurityPkg/SecurityFixes.yaml | 22 ++++++++++++++++++++++
|
|
1 file changed, 22 insertions(+)
|
|
create mode 100644 SecurityPkg/SecurityFixes.yaml
|
|
|
|
diff --git a/SecurityPkg/SecurityFixes.yaml b/SecurityPkg/SecurityFixes.yaml
|
|
new file mode 100644
|
|
index 0000000000..f9e3e7be74
|
|
--- /dev/null
|
|
+++ b/SecurityPkg/SecurityFixes.yaml
|
|
@@ -0,0 +1,22 @@
|
|
+## @file
|
|
+# Security Fixes for SecurityPkg
|
|
+#
|
|
+# Copyright (c) Microsoft Corporation
|
|
+# SPDX-License-Identifier: BSD-2-Clause-Patent
|
|
+##
|
|
+CVE_2022_36763:
|
|
+ commit_titles:
|
|
+ - "SecurityPkg: DxeTpm2Measurement: SECURITY PATCH 4117 - CVE 2022-36763"
|
|
+ - "SecurityPkg: DxeTpmMeasurement: SECURITY PATCH 4117 - CVE 2022-36763"
|
|
+ - "SecurityPkg: : Adding CVE 2022-36763 to SecurityFixes.yaml"
|
|
+ cve: CVE-2022-36763
|
|
+ date_reported: 2022-10-25 11:31 UTC
|
|
+ description: (CVE-2022-36763) - Heap Buffer Overflow in Tcg2MeasureGptTable()
|
|
+ note: This patch is related to and supersedes TCBZ2168
|
|
+ files_impacted:
|
|
+ - Library\DxeTpm2MeasureBootLib\DxeTpm2MeasureBootLib.c
|
|
+ - Library\DxeTpmMeasureBootLib\DxeTpmMeasureBootLib.c
|
|
+ links:
|
|
+ - https://bugzilla.tianocore.org/show_bug.cgi?id=4117
|
|
+ - https://bugzilla.tianocore.org/show_bug.cgi?id=2168
|
|
+ - https://bugzilla.tianocore.org/show_bug.cgi?id=1990
|
|
--
|
|
2.41.0
|
|
|