Re: 回复: [edk2-devel] [PATCH v3 00/20] NetworkPkg: CVE-2023-45236 and CVE-2023-45237

["Michael Brown" <mcb30@ipxe.org>]

On 30/05/2024 11:33, Gerd Hoffmann wrote:
> Most likely it is exactly this ...
> 
>> As of commit
>> https://github.com/ipxe/ipxe/commit/6769a7c3c, we now deliberately leak
>> resources once ExitBootServices has been triggered by skipping the cleanup
>> calls to UninstallMultipleProtocolInterfaces etc.
> 
> ... as the ipxe binaries shipped in upstream qemu repo are older
> than that commit.
> 
> Time to run an update I guess.  Trying to update to current ipxe master
> gives me build errors though (with fedora 40 + gcc 14):

Thank you for the report.  I'm currently still on Fedora 39 locally, but 
will aim to get this build issue sorted in the next few days.  In the 
meantime, if you build iPXE with "make ... NO_WERROR=1" then that should 
work around this particular build failure.

Thanks,

Michael



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#119390): https://edk2.groups.io/g/devel/message/119390
Mute This Topic: https://groups.io/mt/106383321/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-