From 10536b9eaf7e82efd91f570cc685a5fba1d3561e Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Sat, 15 Aug 2026 05:41:08 +0000 Subject: [PATCH 1/2] Patch edk2 for CVE-2026-42770 --- SPECS/edk2/CVE-2026-42770.patch | 47 +++++++++++++++++++++++++++++++++ SPECS/edk2/edk2.spec | 6 ++++- 2 files changed, 52 insertions(+), 1 deletion(-) create mode 100644 SPECS/edk2/CVE-2026-42770.patch diff --git a/SPECS/edk2/CVE-2026-42770.patch b/SPECS/edk2/CVE-2026-42770.patch new file mode 100644 index 00000000000..94d56a8d415 --- /dev/null +++ b/SPECS/edk2/CVE-2026-42770.patch @@ -0,0 +1,47 @@ +From 68c171beaa0afec98f8847daedc480dbe0149183 Mon Sep 17 00:00:00 2001 +From: Norbert Pocs +Date: Tue, 12 May 2026 15:16:04 +0200 +Subject: [PATCH] Match the local q DHX parameter against the peer's q + +As FFC/DH peer public key validation uses the peer's q value instead +of checking against the local q, we must also check that these +q values match when setting the peer's public key. + +Fixes CVE-2026-42770 + +Signed-off-by: Norbert Pocs + +Reviewed-by: Viktor Dukhovni +Reviewed-by: Tomas Mraz +MergeDate: Mon Jun 8 19:56:27 2026 +(cherry picked from commit 29b9df160cc5f20ee3907cce0cb271b982846bce) +Signed-off-by: rpm-build +Upstream-reference: https://github.com/openssl/openssl/commit/7fbfde7677ed8808828bf00ff01c937ca04bdda2.patch +--- + .../openssl/providers/implementations/exchange/dh_exch.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/CryptoPkg/Library/OpensslLib/openssl/providers/implementations/exchange/dh_exch.c b/CryptoPkg/Library/OpensslLib/openssl/providers/implementations/exchange/dh_exch.c +index 1d8a2e2..5c05da7 100644 +--- a/CryptoPkg/Library/OpensslLib/openssl/providers/implementations/exchange/dh_exch.c ++++ b/CryptoPkg/Library/OpensslLib/openssl/providers/implementations/exchange/dh_exch.c +@@ -113,12 +113,15 @@ static int dh_init(void *vpdhctx, void *vdh, const OSSL_PARAM params[]) + static int dh_match_params(DH *priv, DH *peer) + { + int ret; ++ int ignore_q = 1; + FFC_PARAMS *dhparams_priv = ossl_dh_get0_params(priv); + FFC_PARAMS *dhparams_peer = ossl_dh_get0_params(peer); + ++ if (dhparams_priv != NULL && dhparams_priv->q != NULL) ++ ignore_q = 0; + ret = dhparams_priv != NULL + && dhparams_peer != NULL +- && ossl_ffc_params_cmp(dhparams_priv, dhparams_peer, 1); ++ && ossl_ffc_params_cmp(dhparams_priv, dhparams_peer, ignore_q); + if (!ret) + ERR_raise(ERR_LIB_PROV, PROV_R_MISMATCHING_DOMAIN_PARAMETERS); + return ret; +-- +2.45.4 + diff --git a/SPECS/edk2/edk2.spec b/SPECS/edk2/edk2.spec index edf3b6443bb..9d938178812 100644 --- a/SPECS/edk2/edk2.spec +++ b/SPECS/edk2/edk2.spec @@ -56,7 +56,7 @@ Distribution: Azure Linux Name: edk2 Version: %{GITDATE}git%{GITCOMMIT} -Release: 18%{?dist} +Release: 19%{?dist} Summary: UEFI firmware for 64-bit virtual machines License: Apache-2.0 AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-Patent AND BSD-3-Clause AND BSD-4-Clause AND ISC AND MIT AND LicenseRef-Fedora-Public-Domain URL: https://www.tianocore.org @@ -160,6 +160,7 @@ Patch1022: CVE-2026-45445.patch Patch1023: CVE-2026-45447.patch Patch1024: CVE-2026-7383.patch Patch1025: CVE-2026-9076.patch +Patch1026: CVE-2026-42770.patch # python3-devel and libuuid-devel are required for building tools. # python3-devel is also needed for varstore template generation and @@ -807,6 +808,9 @@ done %endif %changelog +* Sat Aug 15 2026 Azure Linux Security Servicing Account - 20240524git3e722403cd16-19 +- Patch for CVE-2026-42770 + * Tue Jun 16 2026 Azure Linux Security Servicing Account - 20240524git3e722403cd16-18 - Patch for CVE-2026-9076, CVE-2026-7383, CVE-2026-45447, CVE-2026-45445, CVE-2026-42767, CVE-2026-42766, CVE-2026-34182, CVE-2026-34180 From cdd07e91e5d3927bdb2b38f7c6ac6aa26c5980a3 Mon Sep 17 00:00:00 2001 From: Kanishk Bansal Date: Sat, 15 Aug 2026 10:30:58 +0000 Subject: [PATCH 2/2] Bump release for consistency with edk2 spec Signed-off-by: Kanishk Bansal --- SPECS-SIGNED/edk2-hvloader-signed/edk2-hvloader-signed.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/SPECS-SIGNED/edk2-hvloader-signed/edk2-hvloader-signed.spec b/SPECS-SIGNED/edk2-hvloader-signed/edk2-hvloader-signed.spec index 05bdd913cee..36a6643740f 100644 --- a/SPECS-SIGNED/edk2-hvloader-signed/edk2-hvloader-signed.spec +++ b/SPECS-SIGNED/edk2-hvloader-signed/edk2-hvloader-signed.spec @@ -11,7 +11,7 @@ Summary: Signed HvLoader.efi for %{buildarch} systems Name: edk2-hvloader-signed-%{buildarch} Version: %{GITDATE}git%{GITCOMMIT} -Release: 18%{?dist} +Release: 19%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Azure Linux @@ -74,6 +74,9 @@ popd /boot/efi/HvLoader.efi %changelog +* Sat Aug 15 2026 Azure Linux Security Servicing Account - 20240524git3e722403cd16-19 +- Bump release for consistency with edk2 spec. + * Tue Jun 16 2026 Azure Linux Security Servicing Account - 20240524git3e722403cd16-18 - Bump release for consistency with edk2 spec.