U-Boot is in need of an update

U-Boot is in need of an update

[Peter Müller]

[-- Attachment #1: Type: text/plain, Size: 804 bytes --]

Hello Arne,

first and foremost, I hope you are well or at least being on the path of recovery.

The other day, I stumbled across https://research.nccgroup.com/2022/06/03/technical-advisory-multiple-vulnerabilities-in-u-boot-cve-2022-30790-cve-2022-30552/,
which reminded me again of wanting to ask you about an update of U-Boot. Since I
do not have any ARM installations in production, and certainly do not have both
experience and a hardware arsenal close to yours, it would be great if you could
have a look at it.

By the way: For Core Update 169, I currently plan to ship both a (smaller) linux-
firmware update and a new kernel. According to the nightly build, we are currently
at 21 MByte, so this might fit in. :-)

Have a nice weekend!

Thanks, and best regards,
Peter Müller

Re: U-Boot is in need of an update

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 1329 bytes --]

Hello,

This email isn’t quite for me, but I wanted to chime in :)

> On 9 Jun 2022, at 21:07, Peter Müller <peter.mueller(a)ipfire.org> wrote:
> 
> Hello Arne,
> 
> first and foremost, I hope you are well or at least being on the path of recovery.
> 
> The other day, I stumbled across https://research.nccgroup.com/2022/06/03/technical-advisory-multiple-vulnerabilities-in-u-boot-cve-2022-30790-cve-2022-30552/,
> which reminded me again of wanting to ask you about an update of U-Boot. Since I
> do not have any ARM installations in production, and certainly do not have both
> experience and a hardware arsenal close to yours, it would be great if you could
> have a look at it.

The vulnerabilities are in the IP stack which we don’t use. However, that is not a reason to not update.

> By the way: For Core Update 169, I currently plan to ship both a (smaller) linux-
> firmware update and a new kernel. According to the nightly build, we are currently
> at 21 MByte, so this might fit in. :-)

Those changes will have to be tested with all the boards. I suppose there is a rather large chance that things can break from one release to another, because not even upstream can test on all the hardware.

-Michael

> 
> Have a nice weekend!
> 
> Thanks, and best regards,
> Peter Müller