Notification time stamped 2021-03-31 19:13:47 UTC
From 7fa9f7acbea94b7a0b2eec1a703cb64b9ffb2cd4 Mon Sep 17 00:00:00 2001
From: Peter Jones <pjones(a)redhat.com>
Date: Mar 31 2021 19:10:57 +0000
Subject: Fix the ia32 build.
Resolves: CVE-2020-14372
Resolves: CVE-2020-25632
Resolves: CVE-2020-25647
Resolves: CVE-2020-27749
Resolves: CVE-2020-27779
Resolves: CVE-2021-20225
Resolves: CVE-2021-20233
Signed-off-by: Peter Jones <pjones(a)redhat.com>
---
diff --git a/0001-Fix-a-broken-file-header-on-ia32.patch
b/0001-Fix-a-broken-file-header-on-ia32.patch
new file mode 100644
index 0000000..1fbcb33
--- /dev/null
+++ b/0001-Fix-a-broken-file-header-on-ia32.patch
@@ -0,0 +1,32 @@
+From 1bea91ba72165d97c3b453cf769cb4bc5c07207a Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones(a)redhat.com>
+Date: Wed, 31 Mar 2021 14:54:52 -0400
+Subject: [PATCH] Fix a broken file header on ia32
+
+Commit c6281c6a195edee61185 needs to have included a ". = ALIGN(4096)"
+directive before .reloc, but fails to do so.
+
+As a result, binutils, which does not care about the actual binary
+format's constraints in any way, does not enforce the section alignment,
+and it will not load.
+
+Signed-off-by: Peter Jones <pjones(a)redhat.com>
+---
+ elf_ia32_efi.lds | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/elf_ia32_efi.lds b/elf_ia32_efi.lds
+index 742e0a47a73..497a3a15265 100644
+--- a/elf_ia32_efi.lds
++++ b/elf_ia32_efi.lds
+@@ -15,6 +15,7 @@ SECTIONS
+ *(.gnu.linkonce.t.*)
+ _etext = .;
+ }
++ . = ALIGN(4096);
+ .reloc :
+ {
+ *(.reloc)
+--
+2.30.2
+
diff --git a/shim-unsigned-x64.spec b/shim-unsigned-x64.spec
index 8e93e94..0135e97 100644
--- a/shim-unsigned-x64.spec
+++ b/shim-unsigned-x64.spec
@@ -20,7 +20,7 @@
Name: shim-unsigned-%{efiarch}
Version: 15.4
-Release: 1%{?dist}
+Release: 2%{?dist}
Summary: First-stage UEFI bootloader
ExclusiveArch: x86_64
License: BSD
@@ -34,6 +34,8 @@ Source3: sbat.redhat.csv
Source100: shim-find-debuginfo.sh
+Patch0001: 0001-Fix-a-broken-file-header-on-ia32.patch
+
BuildRequires: gcc make
BuildRequires: elfutils-libelf-devel
BuildRequires: git openssl-devel openssl
@@ -178,6 +180,16 @@ cd ..
%files debugsource -f build-%{efiarch}/debugsource.list
%changelog
+* Wed Mar 31 2021 Peter Jones <pjones(a)redhat.com> - 15.4-2
+- Fix the ia32 build.
+ Resolves: CVE-2020-14372
+ Resolves: CVE-2020-25632
+ Resolves: CVE-2020-25647
+ Resolves: CVE-2020-27749
+ Resolves: CVE-2020-27779
+ Resolves: CVE-2021-20225
+ Resolves: CVE-2021-20233
+
* Tue Mar 30 2021 Peter Jones <pjones(a)redhat.com> - 15.4-1
- Update to shim 15.4
- Support for revocations via the ".sbat" section and SBAT EFI variable
https://src.fedoraproject.org/rpms/shim-unsigned-x64/c/7fa9f7acbea94b7a0b...