Hello,
This email isn’t quite for me, but I wanted to chime in :)
On 9 Jun 2022, at 21:07, Peter Müller peter.mueller@ipfire.org wrote:
Hello Arne,
first and foremost, I hope you are well or at least being on the path of recovery.
The other day, I stumbled across https://research.nccgroup.com/2022/06/03/technical-advisory-multiple-vulnera..., which reminded me again of wanting to ask you about an update of U-Boot. Since I do not have any ARM installations in production, and certainly do not have both experience and a hardware arsenal close to yours, it would be great if you could have a look at it.
The vulnerabilities are in the IP stack which we don’t use. However, that is not a reason to not update.
By the way: For Core Update 169, I currently plan to ship both a (smaller) linux- firmware update and a new kernel. According to the nightly build, we are currently at 21 MByte, so this might fit in. :-)
Those changes will have to be tested with all the boards. I suppose there is a rather large chance that things can break from one release to another, because not even upstream can test on all the hardware.
-Michael
Have a nice weekend!
Thanks, and best regards, Peter Müller