Re: 回复: [edk2-devel] [PATCH v3 00/20] NetworkPkg: CVE-2023-45236 and CVE-2023-45237

["Gerd Hoffmann" <kraxel@redhat.com>]

On Thu, May 30, 2024 at 10:49:25AM GMT, Michael Brown wrote:
> On 30/05/2024 11:33, Gerd Hoffmann wrote:
> > Most likely it is exactly this ...
> > 
> > > As of commit
> > > https://github.com/ipxe/ipxe/commit/6769a7c3c, we now deliberately leak
> > > resources once ExitBootServices has been triggered by skipping the cleanup
> > > calls to UninstallMultipleProtocolInterfaces etc.
> > 
> > ... as the ipxe binaries shipped in upstream qemu repo are older
> > than that commit.
> > 
> > Time to run an update I guess.  Trying to update to current ipxe master
> > gives me build errors though (with fedora 40 + gcc 14):
> 
> Thank you for the report.  I'm currently still on Fedora 39 locally, but
> will aim to get this build issue sorted in the next few days.  In the
> meantime, if you build iPXE with "make ... NO_WERROR=1" then that should
> work around this particular build failure.

Confirmed that with ipxe updated the issue is gone.

take care,
  Gerd



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#119391): https://edk2.groups.io/g/devel/message/119391
Mute This Topic: https://groups.io/mt/106383321/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-