From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id 77B4ED80D0C for ; Tue, 23 Jan 2024 18:49:16 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=bSNQFYPcsJqI8cZnCUTiqNwQShWksmc8UGLU+rd6KDE=; c=relaxed/simple; d=groups.io; h=ARC-Seal:ARC-Message-Signature:ARC-Authentication-Results:From:To:CC:Subject:Thread-Topic:Thread-Index:Date:Message-ID:References:In-Reply-To:Accept-Language:msip_labels:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Language:Content-Type:Content-Transfer-Encoding; s=20140610; t=1706035755; v=1; b=Yfow+KkgWbVhUXYCuE8ageoHRPgg7Z397euAbd922KFHiQcJ0a74JhBBy6c/byLmYQwWpbKi YCrxq/wNXb/DOcRGjn8jmJapxCHfPr0s3vOz3xEDj6JH40ej9NTZpJgRahd7x3qyFPhWGUR5/B1 J3loAhOQJGuaWtVzNf32fomk= X-Received: by 127.0.0.2 with SMTP id foEFYY7687511x9t60d3o9hq; Tue, 23 Jan 2024 10:49:15 -0800 X-Received: from CY4PR02CU007.outbound.protection.outlook.com (CY4PR02CU007.outbound.protection.outlook.com [40.93.199.15]) by mx.groups.io with SMTP id smtpd.web11.2213.1706035754243048622 for ; Tue, 23 Jan 2024 10:49:14 -0800 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=RFxpo1foz1U/ETu21tg2y1GL4nsVZ+ID+8Qn6Fe4I7/Wy5iKz3RHM3KvhlndxBgZ58RWhiJO+vhs0AotIwKSTVJbJ5X+07p5T5LLb8HFnX+OHJGAko41UEwtjK6upE69IxzNHjyiFPEtWlz6pOSv9WxrAd6xM5nUU+jehHCLrWPccYpDEGQcjZKU1DRaI9B6dTMabFzWahABgdzf0uw6wynuJ4fcuSw7Gv4d+FIjpp0pfzkCD1zV0XNCuDhPPKhF9GIMcMWvJyCXSB2wjrSVOk7t+NgY3Od7qzmdBv2W0LwuX3dmoro8Qt3yLxPhKKkQyCjAcqyb15C98+aG4BWbRQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Gm0QQCbqKWBmLhDTqlWakG111iZwr0BNfK3d8W9AsOo=; b=E6PRV2RMajAT9tEOq217OpDvIphBLFir76BGz6RgZjxxbs/mfoQ1rNkQ3bz2h0pSmhTl04BUJ+TlMzpKeEzQRZLWqe+oLR8lBs++ojBrH+j4zDpRZtKe0+RIVIaWiMr0tDDxdhTaIOBKxhZ3+ZRe+N38QAQwayfQ+OpjDZWj/TTyUpYa2llvgpOOxqBAmmWpGcHVM/sXtq/35n45s2GwQMSEUR9hkTFAKMIdxTf4gm+ZgheYY6i1vVcMpY08pk4X+dHqg3tFzSLd69PXKmqRWnW7H+iRHkGeczGeq57B0VOPqbNZxtAegkH1ae2Oq1DZKxNc+bV0R8uHTcb33plhfg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none X-Received: from MN2PR21MB1247.namprd21.prod.outlook.com (2603:10b6:208:3b::32) by CH2PR21MB1477.namprd21.prod.outlook.com (2603:10b6:610:82::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7249.8; Tue, 23 Jan 2024 18:49:11 +0000 X-Received: from MN2PR21MB1247.namprd21.prod.outlook.com ([fe80::34e9:df0:7c4a:1176]) by MN2PR21MB1247.namprd21.prod.outlook.com ([fe80::34e9:df0:7c4a:1176%4]) with mapi id 15.20.7202.014; Tue, 23 Jan 2024 18:49:11 +0000 From: "Doug Flick via groups.io" To: Gerd Hoffmann , "devel@edk2.groups.io" CC: Jon Maloy Subject: Re: [edk2-devel] pixiefail Thread-Topic: [EXTERNAL] pixiefail Thread-Index: AQHaTho9tPzQ9sZINkecwFt7aJvq4rDnr/PQ Date: Tue, 23 Jan 2024 18:49:11 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=fd8406cd-a518-4f69-9611-36af36db2e7d;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2024-01-23T18:00:41Z;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: MN2PR21MB1247:EE_|CH2PR21MB1477:EE_ x-ms-office365-filtering-correlation-id: 6aa22cd9-788f-48e8-81b0-08dc1c43fd23 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam-message-info: UY3GoadLMDHN4bMqjCIv7JdL+7p7cRjiP8O5Syi4g2kVBZWxqANlO3R5TK052Vsp1FSj8UqmxyDOFzqx6vCz8xbsTUbnvR52MsfHjacQmO5IwTjwzRMEznhWEYOuQPiDcTQRtmguDWAJiyQCx9sB8O5D5mfJYJUjurAb/Wop0o7lD+nuCSNk3MjJQqEie0YoperqnJFKgLDayYCX8kjm0KGoFMsmSO91opIp7gs2129pfCrg+yxQ+yw97Jr991lLlpvMSuyyG8rnynz8PzjMnAuP4NGPGjIHFmtNKoJwlcfcXEMqhnudfJanayOZv4UO/mAXXp8IzVVIQwR55JlQz4cWAhsuiZ2H1LtCLdqCbadb2AuS3DtN+qzZn52y5J70u4dzBooKgKPR5ylHPeMuHyrTBrv1Whf2DuxndVatYOXGu6HqxEMybdTA5C6Y+t9bqQ+XFwVKO2uT581Tnuv0Py+/HfB31rDSbjTTYO63FgTENejwyKR3LtQziaFRfL2KgB/nLNzfazscfAzd4LWpuS0yOnzCIb8UgHudDKyI3eOoOhvWvyKNQfrUIJ7c+II2aHJR7RdiSYgb2PNUopm4Rzq9sx86GqA5qu+8AhH/9QrfzuVDytjBKURUZFDx0fvNCKbnavNJYyY6P3y1TaXkT3ldoTz8PTCbGOQTs+UGdpf/g63WoVXE52P74ABmj5Et x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?rf3QtRg4iRtGHra+zOHw/GQQSdhlvFkxhReFrLiBDbwWU+LvmTQJlkqvQ7vQ?= =?us-ascii?Q?frmz8qtXPssPVMH9wy4fBCLE1OXGr8U+DwYR/HJJSFQ4SdyWTkq8P78vBGmL?= =?us-ascii?Q?/YIbPW35d3g6BvXNighxw2ZmbIB0gjfiqTwepEYbe8CiNbxUc6BspCNXzswV?= =?us-ascii?Q?xNZ/yMn1xGrQwLZLnJ/N5B4w4kN1RdAVvsUmJsbklKEeVtIzvjD+Ragshu5W?= =?us-ascii?Q?6hp6Q5ElvTP7pqJSj8ii1SDl7bX3RWW9NQjwMRJu4p2wsYqjPy5cRGhaAnBm?= =?us-ascii?Q?hCQ88TMbzki5kNV931A7O3pB/DDNr9/O3z2PcHktL7ipOOEXOsyXoC2qtu/L?= =?us-ascii?Q?NftQ3P9D/1GSuWl4wrKZSTbqAlLkCGbgthrdNG1WthZyen05OD1PkRfDdznn?= =?us-ascii?Q?iI49cRF0bti4DAZ9sLUboU9G/vMM1Q9xblPFfbcfe6tydmYVTheRMSETRiKF?= =?us-ascii?Q?A/9ClGtXbknuf+kfAhcCpTw/J6eX+ncacdQsV+zdMGJ5OLk7Yk7k0xmI7sGF?= =?us-ascii?Q?wq+NZdUmF4dYCDwDzq/rca1b/MtGRCevW97gqe5MZuqtO2vystTw0M4jDy1i?= =?us-ascii?Q?NxmLrWMex7y7708u9WgVoaWQ2RAVbOzUaptexQptJvuLLDDlnpSuTG87AhcK?= =?us-ascii?Q?ekXx17npihO/ghqEU7ej8OaAG6NFqM4z3tevnl9rgP/mmGsuecZI6uSwy1AK?= =?us-ascii?Q?27ms4Ggi/sppNumxVtlvLYThskgwSQJZXEhnF66TX15lzY9Ur4X9mmv9iDL2?= =?us-ascii?Q?sSYtKlFibFJeCEXhZaw4CtcWD3efr2/BzyWXZdydMLTgpVksep7T+J3pN0CG?= =?us-ascii?Q?uQi6fn/Ou4CY10WdAtOkBcXXORjYuYVD4bxv9ZO/8LIr2EPYEF+8wZc8Za/k?= =?us-ascii?Q?JUBnEegNoTggw0TKPEd6MeSH5MJB9FR0u+HXYtoeT2EFygHHP9z35Aej+HEt?= =?us-ascii?Q?JNQ+0ipNPfJmo2i9jUCkLwq17OSr/0wkjBbNBezYDBhLEvTRn7Y6uBHYV3o5?= =?us-ascii?Q?MSTwVwn8uNEdlmNOms6ZYlUHkZxhBJlo51+ymvFwm0X6xKUfmaiCOi3ryeLd?= =?us-ascii?Q?3F6GUF2v80YAVP1+Wo0vs2xnwaNskJE9j5sD/flX8gZbYjV+ZR4TjLThFwpj?= =?us-ascii?Q?Rf1/O9gnwpszPQTautgc0hxO0vTAVMchvn9uUoZDbvIKVQGCnD1ojDn6VnKa?= =?us-ascii?Q?BnMx4pQTwpZq4VpvniEpuPZgUNLdnI6BiBdMOJMKhCFXsx3GZqDsIAfc8JNs?= =?us-ascii?Q?Q4Zp3g2FNBeIccUwgnKcXdnNyHln1yCrKZlChSUB+UjIv0tu6d7Qt1yY4zx4?= =?us-ascii?Q?O8FMetCIJwKlHqfMHeDaXSK9KDysGnTWSv5yd7DzdtU28Sppu/9KypvVrDu+?= =?us-ascii?Q?OG67uveRf52++y8f0pU+NcYb2kMnkxvM4ic3N9AfiahB3VJJHvgmGiJxN48S?= =?us-ascii?Q?phJBicGm8RwIQ3lpon4g4Swu6z/As1H0xBzsvCFJ74LVdNhqbSG9/7txEgIc?= =?us-ascii?Q?iUpgKOPuxkwaOpNiNtz1jUoWw1rCi19eo0SNBzXcPbqAlEF1yw39J8j+5KL3?= =?us-ascii?Q?y319dFJDCGjwsVSIzWSzncqoCzhma0KSQt+Mg7kF?= MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MN2PR21MB1247.namprd21.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6aa22cd9-788f-48e8-81b0-08dc1c43fd23 X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Jan 2024 18:49:11.5083 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: E7U/yCUC4IyAj9dZ4slu4TjU7cF5wrkKpmE8IONDAq2pDq2fyCuIDvKq5KBh4UzCHjq3197O0+CKBCqjLtrF3g== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR21MB1477 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,dougflick@microsoft.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: NfCuczqiGR2vQl2CWrZPdA4Dx7686176AA= Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=Yfow+Kkg; spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io; dmarc=none; arc=reject ("signature check failed: fail, {[1] = sig:microsoft.com:reject}") Gerd, As a new EDK2 developer, I'm working through getting the patches up to EDK2= but I have to follow the EDK2 patch process which is not the fastest thing= to follow and also not my day job. If you want to see where I am you can l= ook at the CI Pipeline. The patches were reviewed during the GHSA process b= y the Infosec group and have been shipping in devices already. I'm hoping t= o have the patches on the mailing list by EOD. This is a great topic for wa= ys we can speed up the review process and contribution process - particular= ly for security patches and it would be great to get more people actively i= nvolved in reviews and testing during creation and delivery of patches. - Doug -----Original Message----- From: Gerd Hoffmann Sent: Tuesday, January 23, 2024 8:36 AM To: devel@edk2.groups.io; Doug Flick Cc: Jon Maloy Subject: [EXTERNAL] pixiefail [You don't often get email from kraxel@redhat.com. Learn why this is import= ant at https://aka.ms/LearnAboutSenderIdentification ] Hi, What is the state of affairs wrt. the pixiefail vulnerabilities? The advisory is published (https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h)= , it says the plan is to have the fixes included in the next (Feb 2024) stabl= e tag. I see bugzilla has patches attached, most of them written by Doug F= lick. There is not that much time left until code freeze starts. Shouldn'= t we get the ball rolling to get the patches reviewed and merged? Given th= at the pixiefail details where published last week it should be ok to simpl= y send the patches to the devel list for review. thanks & take care, Gerd -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#114228): https://edk2.groups.io/g/devel/message/114228 Mute This Topic: https://groups.io/mt/103913088/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-