Skip to content

Conversation

@dinhngtu
Copy link
Member

Fallout from the varstored update.

At the moment, test the following scenarios:

  • From the varstored defaults, append MS dbx and verify VM boots
  • From the varstored 1.2.0-3.1 defaults, append MS dbx and verify VM boots (which implies not having the oversized variable append bug)

@dinhngtu dinhngtu requested a review from stormi October 31, 2025 15:00
* Rename secureboot_certs to secureboot_objects
* Delete unused files

Signed-off-by: Tu Dinh <[email protected]>
@guzu
Copy link

guzu commented Nov 13, 2025

I don't understand all of that, but just wonder if part of the message in commit log could make sense as a comment in test ?
Mainly "which implies not having the oversized variable append bug", maybe that's what test_append_with_poison() is just about.

@guzu guzu self-requested a review November 13, 2025 08:34
@dinhngtu
Copy link
Member Author

The context is here: https://xcp-ng.org/blog/2025/10/30/xcp-ng-8-3-varstored-update-unbootable-vm-risk-and-remediation/

In short, the dbx variable previously used in the bad update did not use the Microsoft owner GUID, preventing deduplication of EFI signature data entries during an append call. Normally, this would not cause the VM to crash; except varstored does not check for the variable data length on append (https://redirect.github.com/xapi-project/varstored/commit/46edc9d071bdee42a80b312540c0fc076c227db0, backported but still not released), triggering the issue.

Fallout from the varstored update.

At the moment, test the following scenarios:
* From the varstored defaults, append MS dbx and verify VM boots
* From the varstored 1.2.0-3.1 defaults, append MS dbx and verify VM
  boots (which implies not having the oversized variable append bug)

Signed-off-by: Tu Dinh <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants