Re: CVE-2018-3613 [was: MdeModulePkg Variable: Fix Timestamp zeroing issue on APPEND_WRITE]

["Zeng, Star" <star.zeng@intel.com>]

Hi Laszlo,

On 2018/10/18 21:09, Laszlo Ersek wrote:
> On a tangent:
> 
> On 10/18/18 04:45, Zeng, Star wrote:
>> On 2018/10/18 2:27, Laszlo Ersek wrote:
> 
>>>>> http://mid.mail-archive.com/e62f7104-e341-6c7f-1af5-2130f161f111@redhat.com
> 
>>>> Sorry, I could not access it.
>>>
>>> I'm unsure if you mean that you didn't see that message when I posted
>>> it, or else that you've now tried to follow the link, but it doesn't
>>> work for you. Does the official edk2-devel archive work perhaps? Here's
>>> a link within that, to the same message:
>>>
>>> https://lists.01.org/pipermail/edk2-devel/2018-August/028700.html
>>
>> The edk2-devel archive link works for me. But I did not review this
>> thread and did not see the request. :(
> 
> OK, understood.
> 
>> FYI, I could not access the redhat archive link
>> http://mid.mail-archive.com/e62f7104-e341-6c7f-1af5-2130f161f111@redhat.com,
>> I just heard some other people also could not access it.
> 
> That link isn't a "Red Hat" link. It is a link that points to
> 
>    mid.mail-archive.com
> 
> The site "mid.mail-archive.com" is a search service from
> mail-archive.com. The URL is composed as follows:
> 
>    mid.mail-archive.com + "/" + <Message-Id>
> 
> In the <Message-Id> part, the user can place the message-id header of
> the email that they are looking for.
> 
> In the current case, the Message-Id of the email that I wanted to direct
> you to was:
> 
>    e62f7104-e341-6c7f-1af5-2130f161f111@redhat.com
> 
> It ends with "@redhat.com" only because the message-id was originally
> generated by a RH SMTP server (because the message was sent by me). So,
> the complete link is not a "Red Hat" link; it is a mail-archive.com link
> that happens to end with "@redhat.com" -- because the message ID that I
> put in the URL, for the search service, ends with "@redhat.com".

I am not familiar with using mail-archive.com.
I just did some check and found it is interesting that I could access 
https://www.mail-archive.com/edk2-devel@lists.01.org/msg43513.html, it 
is because it has "https"? Not sure.

Thanks,
Star

> 
> .... Anyway, I understand now that mail-archive.com may not be accessible
> from behind the Great Firewall. I'll try to keep in mind to provide both
> edk2-devel archive links, and mail-archive.com links. (Normally I prefer
> mail-archive.com because it shows the thread structure much better.)
> 
> Thanks!
> Laszlo
>