https://bugzilla.suse.com/show_bug.cgi?id=1218678 Stoyan Manolov changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jlee@suse.com -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1218678 https://bugzilla.suse.com/show_bug.cgi?id=1218678#c2 --- Comment #2 from Joey Lee --- (In reply to SMASH SMASH from comment #0)

EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.

References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-36763 https://www.cve.org/CVERecord?id=CVE-2022-36763 https://github.com/tianocore/edk2/security/advisories/GHSA-xvv8-66cq-prwr

I will backport patch in the above edk2 bug after it be merged to edk2 mainline. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1218678 https://bugzilla.suse.com/show_bug.cgi?id=1218678#c3 --- Comment #3 from Joey Lee --- (In reply to Joey Lee from comment #2)

(In reply to SMASH SMASH from comment #0)

...

EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.

References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-36763 https://www.cve.org/CVERecord?id=CVE-2022-36763 https://github.com/tianocore/edk2/security/advisories/GHSA-xvv8-66cq-prwr

I will backport patch in the above edk2 bug after it be merged to edk2 mainline.

Those patches be merged to edk2 mainline. I will backport them. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1218678 https://bugzilla.suse.com/show_bug.cgi?id=1218678#c5 --- Comment #5 from Joey Lee --- commit 1ddcb9fc6b4164e882687b031e8beacfcf7df29e [edk2-stable202402] Author: Douglas Flick [MSFT] Date: Fri Jan 12 02:16:03 2024 +0800 SecurityPkg: : Adding CVE 2022-36763 to SecurityFixes.yaml commit 4776a1b39ee08fc45c70c1eab5a0195f325000d3 [edk2-stable202402] Author: Douglas Flick [MSFT] Date: Fri Jan 12 02:16:02 2024 +0800 SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4117 - CVE 2022-36763 commit 224446543206450ddb5830e6abd026d61d3c7f4b [edk2-stable202402] Author: Douglas Flick [MSFT] Date: Fri Jan 12 02:16:01 2024 +0800 SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4117 - CVE 2022-36763 -- You are receiving this mail because: You are on the CC list for the bug.