Branch: refs/heads/master
Home: https://github.com/tianocore/edk2
Commit: 4bd628ce9844c04623ade7b875efaa19a6b57b35
https://github.com/tianocore/edk2/commit/4bd628ce9844c04623ade7b875efaa19a6b57b35
Author: Mikey Strauss <[email protected]>
Date: 2026-08-03 (Mon, 03 Aug 2026)
Changed paths:
M SecurityPkg/DeviceSecurity/SpdmLib/libspdm
Log Message:
-----------
SecurityPkg/DeviceSecurity: Update libspdm submodule to 3.8.2
The libspdm submodule was pinned at 3.7.0 (2025-04-03), three releases behind
upstream 3.8.2 (2026-04-03). libspdm processes untrusted responder (device)
data in the SPDM device attestation path, so tracking upstream keeps that
parsing current with fixes and hardening.
Two responder-side advisories were resolved between 3.7.0 and 3.8.2:
- GHSA-j54w-759w-xj3m: out-of-bounds write in GET_CSR handling.
- GHSA-m4wc-xmvg-369f: integer overflow / out-of-bounds read in
GET_MEASUREMENT_EXTENSION_LOG handling.
Both are responder-side. edk2 links SpdmRequesterLib (it acts as the SPDM
Requester that verifies an untrusted device Responder), so these responder
handlers are not built into edk2 images; this update is defense-in-depth
rather than a fix for a path reachable in edk2 today.
The libspdm sources referenced by the SpdmLib INFs are unchanged in 3.8.2
(the only additions are the optional ENDPOINT_INFO capability sources, which
edk2 does not enable), so no INF change is required.
Cc: Jiewen Yao <[email protected]>
Cc: Chris Fernald <[email protected]>
Signed-off-by: Mikey Strauss <[email protected]>
To unsubscribe from these emails, change your notification settings at
https://github.com/tianocore/edk2/settings/notifications
_______________________________________________
edk2-commits mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/edk2-commits
