UbuntuUpdates.org

Package "qemu-efi-arm"

Name: qemu-efi-arm

Description:

UEFI firmware for 32-bit ARM virtual machines
Latest version: 2022.02-3ubuntu0.22.04.5
Release: jammy (22.04)
Level: updates
Repository: main
Head package: edk2
Homepage: http://www.tianocore.org

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "qemu-efi-arm"

All arch deb package
APT INSTALL

Other versions of "qemu-efi-arm" in Jammy

Repository Area Version
base main 2022.02-3
security main 2022.02-3ubuntu0.22.04.5

Changelog

Version: 2022.02-3ubuntu0.22.04.5 2025-11-29 00:07:45 UTC

  edk2 (2022.02-3ubuntu0.22.04.5) jammy-security; urgency=medium

  * SECURITY REGRESSION: UEFI network boot broken (LP: #2133157)
    - d/p/CVE-2023-45236.patch: disabled pending further investigation.
    - d/p/CVE-2023-45237-pre1.patch: disabled pending further investigation.
    - d/p/CVE-2023-45237.patch: disabled pending further investigation.

 -- Marc Deslauriers <email address hidden> Thu, 27 Nov 2025 11:17:41 -0500
Source diff to previous version
2133157 ovmf 2024.02-2ubuntu0.6 broke UEFI network boot for VMs
CVE-2023-45236 EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unaut
CVE-2023-45237 EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unaut

Version: 2022.02-3ubuntu0.22.04.4 2025-11-27 11:15:25 UTC

  edk2 (2022.02-3ubuntu0.22.04.4) jammy-security; urgency=medium

  * SECURITY UPDATE: Read buffer overrun in X509_aux_print()
    - debian/patches/CVE-2021-3712.patch: fix a read buffer overrun in
      X509_aux_print() in
      CryptoPkg/Library/OpensslLib/openssl/crypto/x509/t_x509.c.
    - debian/patches/CVE-2021-3712-2.patch: fix i2v_GENERAL_NAME to not
      assume NUL terminated strings in
      CryptoPkg/Library/OpensslLib/openssl/crypto/x509v3/v3_alt.c,
      CryptoPkg/Library/OpensslLib/openssl/crypto/x509v3/v3_utl.c,
      CryptoPkg/Library/OpensslLib/openssl/include/crypto/x509.h.
    - debian/patches/CVE-2021-3712-3.patch: fix POLICYINFO printing to not
      assume NUL terminated strings in
      CryptoPkg/Library/OpensslLib/openssl/crypto/x509v3/v3_cpols.c.
    - debian/patches/CVE-2021-3712-4.patch: fix printing of
      PROXY_CERT_INFO_EXTENSION to not assume NUL terminated strings in
      CryptoPkg/Library/OpensslLib/openssl/crypto/x509v3/v3_pci.c.
    - debian/patches/CVE-2021-3712-5.patch: fix the name constraints code
      to not assume NUL terminated strings in
      CryptoPkg/Library/OpensslLib/openssl/crypto/x509v3/v3_ncons.c.
    - debian/patches/CVE-2021-3712-6.patch: fix test code to not assume NUL
      terminated strings in
      CryptoPkg/Library/OpensslLib/openssl/test/x509_time_test.c.
    - debian/patches/CVE-2021-3712-7.patch: fix append_ia5 function to not
      assume NUL terminated strings in
      CryptoPkg/Library/OpensslLib/openssl/crypto/x509v3/v3_utl.c.
    - debian/patches/CVE-2021-3712-8.patch: fix NETSCAPE_SPKI_print
      function to not assume NUL terminated strings in
      CryptoPkg/Library/OpensslLib/openssl/crypto/asn1/t_spki.c.
    - debian/patches/CVE-2021-3712-9.patch: fix
      EC_GROUP_new_from_ecparameters to check the base length in
      CryptoPkg/Library/OpensslLib/openssl/crypto/ec/ec_asn1.c.
    - debian/patches/CVE-2021-3712-10.patch: allow fuzz builds to detect
      string overruns in
      CryptoPkg/Library/OpensslLib/openssl/crypto/asn1/asn1_lib.c.
    - debian/patches/CVE-2021-3712-11.patch: fix the error handling in
      i2v_AUTHORITY_KEYID in
      CryptoPkg/Library/OpensslLib/openssl/crypto/x509v3/v3_akey.c.
    - debian/patches/CVE-2021-3712-12.patch: allow fuzz builds to detect
      string overruns in
      CryptoPkg/Library/OpensslLib/openssl/crypto/asn1/asn1_lib.c.
    - debian/patches/CVE-2021-3712-13.patch: fix the name constraints code
      to not assume NUL terminated strings in
      CryptoPkg/Library/OpensslLib/openssl/crypto/x509v3/v3_ncons.c.
    - debian/patches/CVE-2021-3712-14.patch: fix i2v_GENERAL_NAME to not
      assume NUL terminated strings in
      CryptoPkg/Library/OpensslLib/openssl/crypto/x509v3/v3_utl.c.
    - CVE-2021-3712
  * SECURITY UPDATE: Infinite loop in BN_mod_sqrt()
    - debian/patches/CVE-2022-0778-1.patch: fix infinite loop in
      CryptoPkg/Library/OpensslLib/openssl/crypto/bn/bn_sqrt.c.
    - debian/patches/CVE-2022-0778-2.patch: add documentation of
      BN_mod_sqrt() in
      CryptoPkg/Library/OpensslLib/openssl/doc/man3/BN_add.pod.
    - debian/patches/CVE-2022-0778-3.patch: add a negative testcase for
      BN_mod_sqrt in CryptoPkg/Library/OpensslLib/openssl/test/bntest.c,
      CryptoPkg/Library/OpensslLib/openssl/test/recipes/10-test_bn_data/bnmod.txt.
    - CVE-2022-0778
  * SECURITY UPDATE: Timing Oracle in RSA Decryption
    - debian/patches/CVE-2022-4304-1.patch: use alternative fix in
      CryptoPkg/Library/OpensslLib/openssl/crypto/bn/bn_asm.c,
      CryptoPkg/Library/OpensslLib/openssl/crypto/bn/bn_blind.c,
      CryptoPkg/Library/OpensslLib/openssl/crypto/bn/bn_lib.c,
      CryptoPkg/Library/OpensslLib/openssl/crypto/bn/bn_local.h,
      CryptoPkg/Library/OpensslLib/openssl/crypto/rsa/rsa_ossl.c.
    - debian/patches/CVE-2022-4304-2.patch: re-add
      BN_F_OSSL_BN_RSA_DO_UNBLIND which was incorrectly removed in
      iCryptoPkg/Library/OpensslLib/openssl/nclude/openssl/bnerr.h.
    - CVE-2022-4304
  * SECURITY UPDATE: Double free after calling PEM_read_bio_ex
    - debian/patches/CVE-2022-4450-1.patch: avoid dangling ptrs in header
      and data params for PEM_read_bio_ex in
      CryptoPkg/Library/OpensslLib/openssl/crypto/pem/pem_lib.c.
    - debian/patches/CVE-2022-4450-2.patch: add a test in
      CryptoPkg/Library/OpensslLib/openssl/test/pemtest.c.
    - CVE-2022-4450
  * SECURITY UPDATE: Use-after-free following BIO_new_NDEF
    - debian/patches/CVE-2023-0215-1.patch: fix a UAF resulting from a bug
      in BIO_new_NDEF in
      CryptoPkg/Library/OpensslLib/openssl/crypto/asn1/bio_ndef.c.
    - debian/patches/CVE-2023-0215-2.patch: check CMS failure during BIO
      setup with -stream is handled correctly in
      CryptoPkg/Library/OpensslLib/openssl/test/recipes/80-test_cms.t,
      CryptoPkg/Library/OpensslLib/openssl/test/smime-certs/badrsa.pem.
    - CVE-2023-0215
  * SECURITY UPDATE: X.400 address type confusion in X.509 GeneralName
    - debian/patches/CVE-2023-0286.patch: fix GENERAL_NAME_cmp for
      x400Address in
      CryptoPkg/Library/OpensslLib/openssl/crypto/x509/v3_genn.c,
      CryptoPkg/Library/OpensslLib/openssl/include/openssl/x509v3.h,
      CryptoPkg/Library/OpensslLib/openssl/test/v3nametest.c.
    - CVE-2023-0286
  * SECURITY UPDATE: excessive resource use when verifying policy constraints
    - debian/patches/CVE-2023-0464-1.patch: limit the number of nodes created
      in a policy tree (the default limit is set to 1000 nodes).
    - debian/patches/CVE-2023-0464-2.patch: add test cases for the policy
      resource overuse.
    - debian/patches/CVE-2023-0464-3.patch: disable the policy tree
      exponential growth test conditionally.
    - CVE-2023-0464
  * SECURITY UPDATE: invalid certificate policies ignored in leaf certificates
    - debian/patches/CVE-2023-0465-1.patch: ensure that EXFLAG_INVALID_POLICY
      is checked even in leaf certs.
    - debian/patches/CVE-2023-0465-2.patch: generate some certificates with
    
Source diff to previous version
CVE-2021-3712 Read buffer overruns processing ASN.1 strings
CVE-2022-0778 Infinite loop in BN_mod_sqrt() reachable when parsing certificates
CVE-2022-4304 openssl: Timing Oracle in RSA Decryption
CVE-2022-4450 openssl: Double free after calling PEM_read_bio_ex
CVE-2023-0215 openssl: Use-after-free following BIO_new_NDEF
CVE-2023-0286 openssl: X.400 address type confusion in X.509 GeneralName
CVE-2023-0464 A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that includ
CVE-2023-0465 Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain check
CVE-2023-0466 The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. How
CVE-2023-2650 openssl Possible DoS translating ASN.1 object identifiers
CVE-2023-3446 Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_
CVE-2023-3817 Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_
CVE-2023-45236 EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unaut
CVE-2023-45237 EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unaut
CVE-2023-5678 Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary:
CVE-2024-0727 Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summa
CVE-2024-1298 EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A
CVE-2024-13176 Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summ
CVE-2024-2511 Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An atta
CVE-2024-38796 EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network.
CVE-2024-38797 EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via
CVE-2024-38805 EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vu
CVE-2024-4741 Use After Free with SSL_free_buffers
CVE-2024-5535 Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory con
CVE-2024-6119 Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory
CVE-2024-9143 Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds mem
CVE-2025-2295 EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vu
CVE-2025-3770 EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vul

Version: 2022.02-3ubuntu0.22.04.3 2024-10-10 07:07:26 UTC

  edk2 (2022.02-3ubuntu0.22.04.3) jammy-security; urgency=medium

  * SECURITY UPDATE: integer underflow
    - debian/patches/CVE-2021-38578.patch: Add SafeIntLib to check for
      under or overflows
    - CVE-2021-38578

 -- Bruce Cable <email address hidden> Tue, 08 Oct 2024 18:01:17 +1100
Source diff to previous version
CVE-2021-38578 Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.

Version: 2022.02-3ubuntu0.22.04.2 2024-02-15 05:06:56 UTC

  edk2 (2022.02-3ubuntu0.22.04.2) jammy; urgency=medium

  * Cherry-pick security fixes from upstream:
    - Fix heap buffer overflow in Tcg2MeasureGptTable(), CVE-2022-36763
      + 0001-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411.patch
      + 0002-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117.patch
      + 0003-SecurityPkg-Adding-CVE-2022-36763-to-SecurityFixes.y.patch
    - Fix heap buffer overflow in Tcg2MeasurePeImage(), CVE-2022-36764
      + 0001-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411-2.patch
      + 0002-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4118.patch
      + 0003-SecurityPkg-Adding-CVE-2022-36764-to-SecurityFixes.y.patch
    - Fix build failure due to symbol collision in above patches:
      + 0001-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411-3.patch
      + 0002-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117-2.patch
      + 0003-SecurityPkg-Updating-SecurityFixes.yaml-after-symbol.patch
    - Fix integer overflow in CreateHob(), CVE-2022-36765
      + 0001-UefiPayloadPkg-Hob-Integer-Overflow-in-CreateHob.patch
    - Fix a buffer overflow via a long server ID option in DHCPv6
      client, CVE-2023-45230:
      + 0001-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch
      + 0002-NetworkPkg-Add-Unit-tests-to-CI-and-create-Host-Test.patch
      + 0003-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch
    - Fix an out-of-bounds read vulnerability when processing the IA_NA
      or IA_TA option in a DHCPv6 Advertise message, CVE-2023-45229:
      + 0004-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Pa.patch
      + 0005-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Un.patch
    - Fix an out-of-bounds read when processing Neighbor Discovery
      Redirect messages, CVE-2023-45231:
      + 0006-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Patc.patch
      + 0007-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Unit.patch
    - Avoid an infinite loop when parsing unknown options in the
      Destination Options header of IPv6, CVE-2023-45232:
      + 0008-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Patc.patch
      + 0009-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Unit.patch
    - Avoid an infinite loop when parsing a PadN option in the
      Destination Options header of IPv6, CVE-2023-45233:
      + 0010-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch
      + 0011-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch
    - Fix a potential buffer overflow when processing a DNS Servers
      option from a DHCPv6 Advertise message, CVE-2023-45234:
      + 0013-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch
    - Fix a potential buffer overflow when handling a Server ID option
      from a DHCPv6 proxy Advertise message, CVE-2023-45235:
      + 0014-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch
    - Record fixes in a SecurityFix.yaml file:
      + 0015-NetworkPkg-Adds-a-SecurityFix.yaml-file.patch
  * Disable the built-in Shell when SecureBoot is enabled, CVE-2023-48733.
    Thanks to Mate Kukri. LP: #2040137.
    - Backport support for IsSecureBootEnabled():
      + 0001-SecurityPkg-SecureBootVariableLib-Added-newly-suppor.patch
    - Disable the built-in Shell when SecureBoot is enabled:
      + Disable-the-Shell-when-SecureBoot-is-enabled.patch
    - d/tests: Drop the boot-to-shell tests for images w/ Secure Boot active.
    - d/tests: Update run_cmd_check_secure_boot() to not expect shell
      interaction.

 -- dann frazier <email address hidden> Mon, 12 Feb 2024 13:19:59 -0700
Source diff to previous version
CVE-2022-36763 EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network.
CVE-2022-36764 EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. S
CVE-2022-36765 EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local netw
CVE-2023-45230 EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in DHCPv6 client. This vulnerability can be exp
CVE-2023-45229 EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message
CVE-2023-45231 EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing  Neighbor Discovery Redirect message. This vulnerabili
CVE-2023-45232 EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This
CVE-2023-45233 EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the Destination Options header of IPv6. This vu
CVE-2023-4523 Real Time Automation 460 Series products with versions prior to v8.9.8 are vulnerable to cross-site scripting, which could allow an attacker to run a
CVE-2023-45234 EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers option from a DHCPv6 Advertise message. This vu
CVE-2023-45235 EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise messa
CVE-2023-48733 An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot.

Version: 2022.02-3ubuntu0.22.04.1 2022-10-25 10:07:20 UTC

  edk2 (2022.02-3ubuntu0.22.04.1) jammy; urgency=medium

  * Enroll snakeoil keys w/ EnrollDefaultKeys.efi --no-default, fixing
    a regression introduced with the transition to edk2-vars-generator.py.
    LP: #1986692.
  * autopkgtest: Add regression tests for snakeoil images.

 -- dann frazier <email address hidden> Mon, 12 Sep 2022 21:05:26 -0600
1986692 Cannot boot EFI signed by snakeoil keys with OVMF_VARS_4M.snakeoil.fd


About   -   Send Feedback to @ubuntu_updates