Re: [Buildroot] [PATCH v9 05/22] boot/ti-k3-r5-loader: bump to version 2024.01

From: "Yann E. MORIN" <yann.morin.1998@free.fr>
To: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Cc: Alexander Sverdlin <alexander.sverdlin@gmail.com>,
	Anand Gadiyar <gadiyar@ti.com>, Asaf Kahlon <asafka7@gmail.com>,
	Xuanhao Shi <X15000177@gmail.com>,
	James Hilliard <james.hilliard1@gmail.com>,
	Thomas Petazzoni <thomas.petazzoni@bootlin.com>,
	buildroot@buildroot.org, Romain Naour <romain.naour@smile.fr>,
	michael@amarulasolutions.com, linux-amarula@amarulasolutions.com,
	bryce@redpinelabs.com, Andreas Dannenberg <dannenberg@ti.com>
Subject: Re: [Buildroot] [PATCH v9 05/22] boot/ti-k3-r5-loader: bump to version 2024.01
Date: Tue, 19 Mar 2024 23:09:32 +0100	[thread overview]
Message-ID: <ZfoNHD-DlqkkYCRh@landeda> (raw)
In-Reply-To: <20240304153253.732708-6-dario.binacchi@amarulasolutions.com>

Dario, All,

On 2024-03-04 16:32 +0100, Dario Binacchi spake thusly:
> All in-tree configs with the ti-k3-r5 bootloader use a custom version,
> so this patch is mostly for the menuconfig default version
> 
> Suggested-by: Romain Naour <romain.naour@smile.fr>
> Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
[--SNIP--]
> diff --git a/boot/ti-k3-r5-loader/ti-k3-r5-loader.hash b/boot/ti-k3-r5-loader/ti-k3-r5-loader.hash
> index c5d1cb8e09f0..fbe5d215409d 100644
> --- a/boot/ti-k3-r5-loader/ti-k3-r5-loader.hash
> +++ b/boot/ti-k3-r5-loader/ti-k3-r5-loader.hash
> @@ -1,3 +1,3 @@
>  # Locally computed:
> -sha256  50b4482a505bc281ba8470c399a3c26e145e29b23500bc35c50debd7fa46bdf8  u-boot-2022.10.tar.bz2

Removing this hash means that defconfigs that still reference the
2022.10 version, no longer have a hash to validate the download against,
which make it susceptible to CVE-2023-43608 [0] [1].

That was already the case for the two ti-am6?x defconfig in the the two
previous patches, as they already used a custom kernel, a custm ATF, a
custom u-boot: the hashes can't be checked for those versions, so the
two ti am?x defconfigs already hit CVE-2023-43608.

We already fixed another defconfig for a similar issue, see commit
9ebbfeff387 (configs/rock5b: add hash for custom kernel).

Could you look into doing the same for those to TI am6?x defconfig,
please?

In the meantime, I kept the hash for 2022.10 for ti-k3-r5-loader
(really, for uboot), to abvoid the issue at least for ti-k3-r5-loader.

Speaking of that, by the way, ti-k3-r5-loader really is uboot, so I
think that it should share:

 1. the same DL_DIR:   TI_K3_R5_LOADER_DL_SUBDIR = uboot

 2. the same hash file:  have ti-k3-r5-loader.hash be a symlink to
    uboot.hash  (and have a xomment at the top of that hash file that it
    is shared and that old hashes should/can be kept)

Do you think that makes sense? If so, would you like to look into it?

[0] https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-43608
[1] https://talosintelligence.com/vulnerability_reports/TALOS-2023-1844

Regards,
Yann E. MORIN.

> +sha256  b99611f1ed237bf3541bdc8434b68c96a6e05967061f992443cb30aabebef5b3  u-boot-2024.01.tar.bz2
>  sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  Licenses/gpl-2.0.txt
> -- 
> 2.43.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot