Re: [edk2-devel] [PATCH v3 00/20] NetworkPkg: CVE-2023-45236 and CVE-2023-45237

["Gerd Hoffmann" <kraxel@redhat.com>]

On Fri, May 24, 2024 at 11:41:04AM GMT, Ard Biesheuvel wrote:
> On Fri, 24 May 2024 at 11:12, gaoliming via groups.io
> <gaoliming=byosoft.com.cn@groups.io> wrote:
> >
> > Ard:
> >   Here is Doug PR https://github.com/tianocore/edk2/pull/5582 that includes 20 commits. You can check them.
> >
> 
> This looks fine to me in principle.
> 
> Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
> 
> However, IIUC, the impact of this series is that all out-of-tree
> platforms that lack the right implementation of the EFI_RNG_PROTOCOL
> (i.e., using a GUID that appears in the allowlist) will lose the
> ability to do network boot. If that is a tolerable result, I am fine
> with that too, but I think it needs to be made very clear in the
> stable tag release notes.

Tested the v3 series with OVMF, results are as expected:  Without
virtio-rng-pci network boot does not work.  With virtio-rng-pci
everything is fine.

Tested-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>

Agree that this must be noted in the release notes.

Related: I'm working on patch series adding RngDxe to OVMF with
runtime rdrand detection:
https://github.com/kraxel/edk2/commits/devel/ovmf-rdrand/

take care,
  Gerd



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#119254): https://edk2.groups.io/g/devel/message/119254
Mute This Topic: https://groups.io/mt/106278600/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-