Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package efivar for openSUSE:Factory checked in at 2026-11-01 22:22:32 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/efivar (Old) and /work/SRC/openSUSE:Factory/.efivar.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "efivar" Sun Nov 1 22:22:32 2026 rev:25 rq:1393819 version:39 Changes: -------- --- /work/SRC/openSUSE:Factory/efivar/efivar.changes 2024-10-12 13:25:01.110518415 +0200 +++ /work/SRC/openSUSE:Factory/.efivar.new.1255/efivar.changes 2026-11-01 22:23:07.337260683 +0100 @@ -1,0 +2,36 @@ +Fri Oct 30 07:11:02 UTC 2026 - Gary Ching-Pang Lin <[email protected]> + +- Add efivar-bsc1286645-revert-file-wrapper-removal.patch to revert + the removal of "File()" (bsc#1286645) +- CVE-2026-6862: efivar: stack overflow in device path node parsing + can cause a denial of service (bsc#1262696) + * efivar-bsc1262696-fix-stack-overflow-in-device-path-parsing.patch + +------------------------------------------------------------------- +Sun Oct 18 10:56:36 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to 39: + * efivar CLI: -A accepts hex values, -a can create a + non-existent variable + * Revamped efi_well_known variable handling + * File device paths no longer print "File(" or ")" + * Fixed IPv4 and IPv6 device path printing + * Handle non-ACPI systems in device_get + * Headers gained extern "C" for easier use by C++ + * Build fixes: musl libc, i686 format error, riscv64 -march, + gcc-13, invalid free in main + * Make-based build: LLD detection fixes, removed deprecated + --add-needed linker flag, docs can be disabled + * Upstream moved from rhinstaller to the rhboot organization +- Drop efivar-bsc1202209-fix-glibc-2.36-build.patch, + efivar-adjust-dependency.patch and + efivar-bsc1206388-revamp-efi_well_known-variable-handling.patch: + all fixed upstream in this release +- Rebase efivar-filter-gcc-march.patch for the upstream riscv64 + rework (boo#1231368) +- Rebase libefiboot-export-disk_get_partition_info.patch for the + upstream extern "C" header rework +- Switch Source to the rhboot tag archive: upstream published no + release tarball for 39 + +------------------------------------------------------------------- Old: ---- efivar-38.tar.bz2 efivar-adjust-dependency.patch efivar-bsc1202209-fix-glibc-2.36-build.patch efivar-bsc1206388-revamp-efi_well_known-variable-handling.patch New: ---- efivar-39.tar.gz efivar-bsc1262696-fix-stack-overflow-in-device-path-parsing.patch efivar-bsc1286645-revert-file-wrapper-removal.patch ----------(Old B)---------- Old:- Drop efivar-bsc1202209-fix-glibc-2.36-build.patch, efivar-adjust-dependency.patch and efivar-bsc1206388-revamp-efi_well_known-variable-handling.patch: Old: * Upstream moved from rhinstaller to the rhboot organization - Drop efivar-bsc1202209-fix-glibc-2.36-build.patch, efivar-adjust-dependency.patch and Old: efivar-adjust-dependency.patch and efivar-bsc1206388-revamp-efi_well_known-variable-handling.patch: all fixed upstream in this release ----------(Old E)---------- ----------(New B)---------- New: can cause a denial of service (bsc#1262696) * efivar-bsc1262696-fix-stack-overflow-in-device-path-parsing.patch New: - Add efivar-bsc1286645-revert-file-wrapper-removal.patch to revert the removal of "File()" (bsc#1286645) ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ efivar.spec ++++++ --- /var/tmp/diff_new_pack.xU5XBp/_old 2026-11-01 22:23:09.351344128 +0100 +++ /var/tmp/diff_new_pack.xU5XBp/_new 2026-11-01 22:23:09.353344211 +0100 @@ -1,7 +1,7 @@ # # spec file for package efivar # -# Copyright (c) 2023 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -18,18 +18,16 @@ %define major 1 Name: efivar -Version: 38 +Version: 39 Release: 0 Summary: Tools to manage UEFI variables License: LGPL-2.1-only -Group: Development/Libraries/C and C++ -URL: https://github.com/rhinstaller/efivar -Source: https://github.com/rhinstaller/%{name}/releases/download/%{version}/%{name}-%{version}.tar.bz2 +URL: https://github.com/rhboot/efivar +Source: https://github.com/rhboot/efivar/archive/refs/tags/%{version}.tar.gz#/efivar-%{version}.tar.gz Patch0: libefiboot-export-disk_get_partition_info.patch -Patch1: efivar-bsc1202209-fix-glibc-2.36-build.patch -Patch2: efivar-adjust-dependency.patch -Patch3: efivar-filter-gcc-march.patch -Patch4: efivar-bsc1206388-revamp-efi_well_known-variable-handling.patch +Patch1: efivar-filter-gcc-march.patch +Patch2: efivar-bsc1286645-revert-file-wrapper-removal.patch +Patch3: efivar-bsc1262696-fix-stack-overflow-in-device-path-parsing.patch BuildRequires: fdupes BuildRequires: pkgconfig BuildRequires: pkgconfig(popt) @@ -40,14 +38,12 @@ %package -n libefivar%{major} Summary: Library to manage UEFI variables -Group: System/Libraries %description -n libefivar%{major} Library to allow for the simple manipulation of UEFI variables. %package devel Summary: Development headers for libefivar -Group: Development/Libraries/C and C++ Requires: libefivar%{major} = %{version}-%{release} %description devel ++++++ efivar-bsc1262696-fix-stack-overflow-in-device-path-parsing.patch ++++++ >From 3a1229ad8e0738823703df30a166228c9fcfaccb Mon Sep 17 00:00:00 2001 From: Marta Lewandowska <[email protected]> Date: Thu, 23 Apr 2026 13:04:50 +0200 Subject: [PATCH] Fix stack overflow caused by infinite recursion If an EFI device path node has 0 length, loop will never terminate. Resolves: bz#2459982 Resolves: CVE-2026-6862 Signed-off-by: Marta Lewandowska <[email protected]> --- src/include/efivar/efivar-dp.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/include/efivar/efivar-dp.h b/src/include/efivar/efivar-dp.h index 85a7f54..61d6002 100644 --- a/src/include/efivar/efivar-dp.h +++ b/src/include/efivar/efivar-dp.h @@ -1122,6 +1122,8 @@ efidp_is_valid(const_efidp dp, ssize_t limit) efidp_header *next; if (limit < (int64_t)(sizeof (efidp_header))) return 0; + if (hdr->length < 4) + return 0; switch (hdr->type) { case EFIDP_HARDWARE_TYPE: -- 2.51.0 ++++++ efivar-bsc1286645-revert-file-wrapper-removal.patch ++++++ >From 3c89230da8677fa6c1375f567324583dbd4e7f31 Mon Sep 17 00:00:00 2001 From: Gary Lin <[email protected]> Date: Fri, 30 Oct 2026 15:09:12 +0800 Subject: [PATCH] Revert "File device paths: don't print "File(" or ")"" This reverts commit 9a5e71044bb7262e049793a9759ced5496f11757. Removing "File(" and ")" from EFIDP_MEDIA_FILE formatting causes efibootmgr and efibootdump to output the formatted file path fused directly to the load option's optional data without any whitespace or delimiter (e.g. ".../loader.efiroot=/dev/sda2"). This breaks downstream tools that extract the bootloader path from CLI output. Apply this revert until efibootmgr upstream fixes the optional data delimiter issue. --- src/dp-media.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/dp-media.c b/src/dp-media.c index ffda361..df47264 100644 --- a/src/dp-media.c +++ b/src/dp-media.c @@ -60,7 +60,9 @@ _format_media_dn(unsigned char *buf, size_t size, const_efidp dp) case EFIDP_MEDIA_FILE: { size_t limit = (efidp_node_size(dp) - offsetof(efidp_file, name)) / 2; + format(buf, size, off, "File", "File("); format_ucs2(buf, size, off, "File", dp->file.name, limit); + format(buf, size, off, "File", ")"); break; } case EFIDP_MEDIA_PROTOCOL: -- 2.51.0 ++++++ efivar-filter-gcc-march.patch ++++++ --- /var/tmp/diff_new_pack.xU5XBp/_old 2026-11-01 22:23:09.401346200 +0100 +++ /var/tmp/diff_new_pack.xU5XBp/_new 2026-11-01 22:23:09.404346324 +0100 @@ -18,16 +18,13 @@ index 9da5182..94502ed 100644 --- a/src/include/defaults.mk +++ b/src/include/defaults.mk -@@ -70,7 +70,7 @@ override SOFLAGS = $(_SOFLAGS) \ +@@ -72,7 +72,7 @@ $(call family,SOFLAGS) - + HOST_ARCH=$(shell uname -m) -ifneq ($(HOST_ARCH),ia64) +ifeq (0,1) + ifneq ($(HOST_ARCH),riscv64) HOST_MARCH=-march=native else - HOST_MARCH= --- -2.35.3 - ++++++ libefiboot-export-disk_get_partition_info.patch ++++++ --- /var/tmp/diff_new_pack.xU5XBp/_old 2026-11-01 22:23:09.420346987 +0100 +++ /var/tmp/diff_new_pack.xU5XBp/_new 2026-11-01 22:23:09.423347111 +0100 @@ -78,11 +78,15 @@ =================================================================== --- efivar-38.orig/src/include/efivar/efiboot.h +++ efivar-38/src/include/efivar/efiboot.h -@@ -20,6 +20,7 @@ - +@@ -20,8 +20,9 @@ + #include <efivar/efiboot-creator.h> #include <efivar/efiboot-loadopt.h> +#include <efivar/efiboot-disk.h> + + #ifdef __cplusplus + extern "C" { + #endif extern uint32_t efi_get_libefiboot_version(void) __attribute__((__visibility__("default")));
