Critical bug in RTC code for a leap year

Michał Żygowski <[email protected]>
Newsgroups gmane.linux.bios
Organization 3mdeb Sp. z o.o.
Message-ID <[email protected]>
Hi folks,

Another leap year, another problem with RTC in firmwares :) This time,
unfortunately, this kind of bugs hit coreboot.

I have issued a patch that fixes off-by-one error in the days count in
month for a leap year:
https://review.coreboot.org/c/coreboot/+/80790

It is quite critical, because depending on build date, it may revert to
some very old date, like January 2023 or even older (depending on how
long you run on current firmware). That said, the consequences are
enormous: from false-negative expired certificates, to problems with
filesystems, etc.

It is worth considering an emergency coreboot release, is it not?

Best regards,

-- 
Michał Żygowski
Firmware Engineer
GPG: 6B5BA214D21FCEB2
https://3mdeb.com | @3mdeb_com

_______________________________________________
coreboot mailing list -- [email protected]
To unsubscribe send an email to [email protected]
OpenPGP_0x6B5BA214D21FCEB2.asc (application/pgp-keys, 3.8 KB)
-----BEGIN PGP PUBLIC KEY BLOCK-----

xsFNBFn4WzYBEADIFGje2/SdbwwxgmzgWLG4+5gsf6UdpRDAMU13tAI/r8gkdFuB
4vnjvGbbJMWlCgiJ/yX1NQgtYC1i4uFr4U9Ertw/j2DG8a7YkQSRa4vKczYkG3mi
DFwE/pk7cyme6CsDRb9tp+3A7sGa4e9lCZMSKfaeR5Cr1+en4JtFtAryBE37Apus
nJKqpCxXyXIJOtYrVTTD7PHa3KTdtt33hgP7fxF7CKwIWl0hLz1UXNLRsDaKccGx
4FcWUFj70e8yvzARh6EnzfXcCINGLjN6BxVK5JiZt2DEKTL+HH41dOG64L/fNDVS
O7NeqczvW4lM8TGvlbBxt8gX3Kb2B1oCPI5u+j5NGIEizGk3+C/hZzEyAXnJEYfW
zYz7+sAtUQc/0LI7Rm4+xA2Cw7iCmy13xtT4bVvqBZQOblKYLR+0/oMFi5Xtpwx1
0/vpVzpgMJqHXohDbsLYAAxatP/jEPFeRfwPghTHjtahyPf+COaOHHGHiNfOXx/a
bdwjrEMyHNaXtrqDTilP4tdPqott8k964rmdBlpVv+Hbi2JrHZnH6raHXKG4Nbbr
ZKVXdLt2gHhxWxhEkLYpZ5HAT9zGNDf2L5dpu2gWCH8gczDV6/dE7X4JS9bvkmFJ
tV8Bnv8VuT+K/5z8SQpU8MjcUGFwdL+UUJk7y18mmCZ1kagyIbHFUqN6wwARAQAB
zTZNaWNoYcWCIMW7eWdvd3NraSAobWljenlnKSA8bWljaGFsLnp5Z293c2tpQDNt
ZGViLmNvbT7CwZUEEwECAD8CGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAFiEE
ALiPsl/WN1vF/xlda1uiFNIfzrIFAlyaCRIFCQwHr1wACgkQa1uiFNIfzrIDTg/+
MXI7BjewwXyUjzSzlGQBY5KzIKoUVM9B5GB+RPuPegcZeKoJCgzlGyqAPcr8nH3n
xOq2eI70/NEN5+//oJOmb6PWivXz2MJSIf4koHW4WZTRhLSsIc0TiHv4n3jUXv6B
6xspiGa7hCfESj+1QkKePM6VIDGv3T9eYms65FQUKUeoV5oZvPqlVvumMi1ujuLK
VJaCuy6XywUnefOyBONogFCeyCb6OU5lrf0e4jlau+ggAs5SDS8+ZB480ebYpaAD
nLrNf7y/+isdlWfRVzoEkZXNTSN9DkvWBgccTNH1+6MiVUBjJjF+FNUoKJ0KAUh8
G2+gjAA8Bj+nucUdMH1AfEzffZ12HG/oxJQ0ZnhA8HSApt9GDxG7oZeHmEeBrmRg
JyRltDA6f/2NDXcN8C4gKfm0A0C/mJP6a8NNDn/Le+DJ8XCsoVBOeVAsq7VdoRkN
w7aLdQYyYEUjBPKd9jBcrVfNMxE2GYFmiiKtGBslzHyhotYJ/FPmeK1d5Of5mlmN
V1awzD8hNWaS3FIuldz7iN0XZQ4k6/ymaCI/m4KVPLw6trQsXzl8y3sQ6Ps34qef
cO6+hdxYtKy630z/3+ZqdWJK7ohNeva0xD50Mt08zjxpNHYW2mRWmwnTZ6FpDDrK
S4o6vT/7KyHZdGhEZT/X9vJkZJwYuFD9GIeltvslkuvCwXgEEwECACIFAln4WzYC
GwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEGtbohTSH86yVjcP/3d4QFj+
v8zhxqT7Uuu2zkCi/xuJmqSpFIMghkxEX92oUU/PsxMI96WqAPiGoXToZcvIrMbI
FP0h0IPw0cvWi6+yjf9UnBENmmppEWcYYtlMDSmHUEX2YQg2zH3OzBYSoQGOw83/
oAipLtcQTmk7KulQ8/PWSMRp1zw180jzcqVCfvYroiIA/MJ4DuW0s1DaN3Lzrnpi
ZVpEZBLn+y3OaSZTDOYd/zmd62jsu3sNHrOvjQk36nxQUhX/y3fx7WWOVRH+EriP
ldLNFJJBVKuBO7W3oFf/gPAJqkXZ/iBNWwLKsETU/2MtoVF/GcIATbhrkWCIv6+O
6q2Sxvh14TBnsb3c0/DN2YLfprI2l1GtdhoFrpngeDqgEd1T2KA+rl7eZd6yIvP2
yCpWoKbMZI9VCDmV0Hu7U19S11QEfiQx2poOuxujnKeviGFU2o/y8rKwO48V1e8d
WX5Ll/+oaeAXO5XJR2UaXbz3FZ+aZxn6XKCJ6MjwtaAZbqwDTzP4Z2rfu1+alvTf
l8eoEFbRj5SgbCH4COQwojyv8mKu7Y16MTCZLXP2Qrr/kfGcgLU6RdNm/0DNnoff
xW/152djbwBg9Irpb3useY4Fcfw857gGgTPOTujVQpx/zOnXXqrkntgp7zoRsBkI
pnVyf6lS9H9gtsM6Imhc+6nRkQFeC4VcM2rUzsFNBFn4WzYBEADWjIytP3oFAkZy
TVCMtctjfdTLIIGokzT+uHl6WOwrA8dKYOUP3fvED29fdD3DMu63aPdNtLz4n/dw
13yFGZf/YD/fuW8hwM9sBeW7RaYu9ewVPJFsMQuf61bM03D9wdyLqcXdD2r7q7ye
C5tSzwnFyV/skZHgzUGpoFNSNlBVMFqo+zDjshWvgBzmlbH8HgrtcoSdji6Ns75X
LNkmjvEqPMOXtBcRYlwzRUixUgz7ff8Iog7fF5oHvTV9VVAQKb7vIg3GEsnjXaIv
YZl9/1Gyk0cXwjsNhc6BjMYSA3I5QLwX5kl87nRVhEguCXlUkjOEG3px9+72E2N0
1uqIUNh49GufHHrYwajPFY10VsKrReIO8L5bKdRfnOyXPOZWye4zXZFWw9gk85DH
D4YPkL3wcq1zjSzZI8+yJ5N8UmDdOX8H1phDx6i3QbbufF0GJ5SN3/byXlItKSLa
c9UfvzaoO05i4uFIroxyrj9L5JUG0wSLW1x2ljtlxfs/vo4omlnIVxDlbwAlZ3gT
uVC/5sitIBaAU+jdQCwifDFSHuIRi20aeWWX0BNKVCkYx5mh1+rs8OTnvC4+QJk3
UHw39nPCvEL1hFs7odbPTBzeBOxT2E6oGn57DkxPXFLV2idCEgbXfFRE/+mggcoU
TD+oGOMu6gImSzi8bQ1Mb1GIrVFkWwARAQABwsFfBBgBAgAJBQJZ+Fs2AhsMAAoJ
EGtbohTSH86yuw4P/RZka9mQj5QnOKO+c54XsdOll9/MThdtwi3PMJ8Y9rPtW5/e
joduVGUI0gG007Qr+BJQOSopdFrXysXDu7ucs+DCA/BVLQyHoeHzwEYxK8fc0VvK
0TsyaaTG3yYXg5w1FwsTsdXYmKz0bJ0piONWXsXZauV8BLQ/xT0uq3U/3e5e5WOS
QIYnY1jsw7Lfd/azGC0FgUm0Yv1CzxetbWGho23gqGfm35v6QDFyhmnkSYNcb9PN
Gqbmwo2GZl+qpjHnUYp/u4sr1SglDHTatqP8hHoY/66C+eTJlxomO9SQ6Bfe3oo7
/9rouF8q4jd9kQ/hQLRAcdbs8TUjtVhwi8Ptwv1v5ZQ5R3nux0Q9ZMmlkKRKRY2n
PjRt6k+X0hMNZInk2W8TcFS3JsDlOS2lpDTKDGzpCdRyk5i+aKLXFt//iCHoa+IU
JAbLuOpYZ7Ec1VmOSjnfdZlT/y9KjxSn6PGmwH3ZVCtV6YYIYhEN34MTj56Mw5Tb
QqyjgBOUhW5ge59nAkXgj1okAMctiVBQxlWn03MHPCuDSxoLr+VK5M2RzsklRz7V
gt/qFjlesh4QZtBxZDmWOrtCjyuz2kFVWqmi0hGhNXunz9d1RmmkCI0B+LooxOe4
Fc/BdOmt0Zg9Ct5pQ/sORmHs5FSoNoSP5J3pmsjIF+RCnxS2Ruf9m8VlNgbI
=FGFm
-----END PGP PUBLIC KEY BLOCK-----
OpenPGP_signature.asc (application/pgp-signature, 833 B)
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEALiPsl/WN1vF/xlda1uiFNIfzrIFAmXgY30ACgkQa1uiFNIf
zrKfRw/9GPziCvPXFoOJWc2/HI9UJkPJKGWAIZWwB1QFf8cDGm5qFmX6ukdp3wde
PX/Z9hk7l3JMt822Gfi5Mk2Pk9HEUfOkE3B45S8O6JZ9acqs+WdeM4sN1FV5tcQ8
oWeAWp9trkOIA9+viUxwlxEaOsOOus3lS/7rGszifksn8fTBf/qROXWTFch9k9QU
hYzdcpCd9NcQ6MGGm6oT4kun6pBYDCSEgdCopGqRzPFkwTLN9GhKEAZXQD1vvRmY
bHNoYxlzZxt2jBeBUf8+Bcksoj1yUxK0KP7iiKq5bjsAqmqTMc5IJyu3xFmmDwlz
Y3se7cS6SQnaQamBS+lXx4YJ8n+2/td3cX9fka734QOzmE9QkH7rnFBYGp4K1ZUJ
lCThpE5+UWR9gGcB9B6Rc1imy0uBUsYPJde3GN5mKRR4CkgKvGJFXgXRL7KQ90vQ
kDox4aCtjoMkFO+G8KojXyEjXTb7lrPG5+DJ7rv0wPIL8WQ/BHsRvcimalY5Go41
A2MooZodK3McXx9uyTyoSFP8pX5a2nDI1rrBzxz+QdGFu/gx0cqrnuxRtiGfRhVm
rCrXkUOmJCjv+dMU5vXoCA8JmFuUqkm4LfjWufzRKsao8507KYLO8qRJZkF4g2qb
GpUXmObCrydBOuRU6SJGkATg3D3BgSTc4H6qvg+hZXuZHMUwzdk=
=oGhT
-----END PGP SIGNATURE-----
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.