Re: [edk2-devel] [PATCH 0/3] [edk2-stable202402] Corrects additional concern in NetworkPkg

["Saloni Kasbekar" <saloni.kasbekar@intel.com>]

Hi Mike,

Could you please consider taking this for the edk2-stable202402 patches? While they weren't part of the bugs reported by Quarkslab, they follow a similar pattern and expose similar vulnerabilities to the bugs reported. My recommendation would be to pull in these changes for the stable release so that we have all the known vulnerabilities fixed as a part of the release.

Thanks,
Saloni

-----Original Message-----
From: Douglas Flick [MSFT] <doug.edk2@gmail.com> 
Sent: Friday, February 9, 2024 7:05 PM
To: devel@edk2.groups.io
Cc: Douglas Flick [MSFT] <doug.edk2@gmail.com>; Kasbekar, Saloni <saloni.kasbekar@intel.com>; Clark-williams, Zachary <zachary.clark-williams@intel.com>; Andrew Fish <afish@apple.com>; Leif Lindholm <quic_llindhol@quicinc.com>; Kinney, Michael D <michael.d.kinney@intel.com>
Subject: [PATCH 0/3] [edk2-stable202402] Corrects additional concern in NetworkPkg

After talking with Micheal Kinney, I was advised to resend these with edk2-stable202402, and CC Stewards.

These patches are time sensitive and need reviews.

This patch series corrects an additional security concern found in Dhc6Dxe related to CVE-2023-45229. 

Additionally this fixes some issues on the mailing list that were not pulled in before merging into Edk2.

Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>

Cc: Andrew Fish <afish@apple.com>
Cc: Leif Lindholm <quic_llindhol@quicinc.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>

Doug Flick (3):
  [edk2-stable202402] NetworkPkg: Dhcp6Dxe: SECURITY PATCH
    CVE-2023-45229 Related Patch
  [edk2-stable202402] NetworkPkg: Dhcp6Dxe: Additional Code Cleanup
  [edk2-stable202402] NetworkPkg: : Updating SecurityFixes.yaml

 NetworkPkg/Dhcp6Dxe/Dhcp6Io.c      | 232 +++++++++++++++++------------
 NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c |  20 +--
 NetworkPkg/SecurityFixes.yaml      |   1 +
 3 files changed, 141 insertions(+), 112 deletions(-)

--
2.43.0


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#115366): https://edk2.groups.io/g/devel/message/115366
Mute This Topic: https://groups.io/mt/104272125/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-