CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

sysutils/edk2 g202508_3

EDK2 Firmware for bhyve

18
unaddressed
0
VuXML only
0
fixed
5
open problem reports
Maintainer
uboot@FreeBSD.org
Packages
latest: edk2-bhyve g202508_3, edk2-fvp g202508_3, edk2-macchiatobin g202508_3, edk2-qemu-i386 g202508_3, edk2-qemu-x64 g202508_3, edk2-rpi3 g202508_3, edk2-rpi4 g202508_3, edk2-xen-x64 g202508_3
Upstream
up to date
Last update
to g202508_3 · 0e7554170a
Quarterly
2026Q4: edk2-bhyve g202508_3, edk2-fvp g202508_3, edk2-macchiatobin g202508_3, edk2-qemu-i386 g202508_3, edk2-qemu-x64 g202508_3, edk2-rpi3 g202508_3, edk2-rpi4 g202508_3, edk2-xen-x64 g202508_3
Formerly
sysutils/edk2@xen until 2021-05-18
WWW
https://github.com/tianocore/edk2/
Links
cgit · VuXML

Unaddressed (18)

The CVE record lists the packaged version g202508_3 as affected, and no VuXML entry names the CVE. What does this mean?

Update to 202008 fixes 2 of the 18 unaddressed CVEs.
16 CVEs name no fixed version in the CVE record (for example only a commit).
Fixed up to each version, cumulative: svn.16280 1 · 202008 2
CVECVSSPublishedDescription
CVE-2023-452348.32024-01-16EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers option from a DHCPv6 Advertise message. This vulnerability can be e…
CVE-2023-452358.32024-01-16EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise message. This vulnerabil…
CVE-2023-452308.32024-01-16EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in DHCPv6 client. This vulnerability can be exploited by an attacke…
CVE-2021-385758.12021-12-01NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.
CVE-2021-282107.82021-06-11An unlimited recursion in DxeCore in EDK II.
CVE-2023-452327.52024-01-16EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can b…
CVE-2023-452337.52024-01-16EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the Destination Options header of IPv6. This vulnerability can be e…
CVE-2021-385787.42022-03-03Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.
CVE-2022-367637.02024-01-09EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitat…
CVE-2022-367647.02024-01-09EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitati…
CVE-2022-367657.02024-01-09EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful expl…
CVE-2014-82716.82020-02-06Buffer overflow in the Reclaim function in Tianocore EDK2 before SVN 16280 allows physically proximate attackers to gain privileges via a long variable name.
CVE-2023-487336.72024-02-14An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot.
CVE-2023-497216.72024-02-14An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass Secure Boot.
CVE-2023-452296.52024-01-16EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message. This vulnerabilit…
CVE-2023-452316.52024-01-16EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing  Neighbor Discovery Redirect message. This vulnerability can be exploited …
CVE-2023-452365.82024-01-16EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and …
CVE-2023-452375.32024-01-16EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and …

VuXML only (0)

Listed in VuXML, the packaged version g202508_3 is still in the affected range; pkg audit reports it. What does this mean?

None.

Not counted (2)

CVEs that match this port only loosely: inherited from the whole project, or with versions that cannot be compared. What does this mean?

2 with versions that cannot be compared
The CVE record gives dates or the port uses snapshot versions (or the other way round), so the version of this port cannot be placed in the affected range.
CVECVSSPublishedDescription
CVE-2019-145847.82021-06-03Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2017-57317.82019-10-28Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access.

Fixed (0)

No VuXML entries for this package.

Problem reports (5) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
295943maintainer-feedback? sysutils/edk2: Update to 202605New2026-10-03
294520sysutils/edk2: g202508 removed components silentlyOpen2026-07-04
292897maintainer-feedback? sysutils/edk2 cannot boot old windows server 2008r2New2026-06-11
294516sysutils/edk2: serial console is resized to abysmal size after update to g202508New2026-06-11
294540maintainer-feedback? sysutils/edk2: Serial console goes bezerk after upgrade to g202508 if no fbuf (graphics) is attachedNew2026-06-11

Commits (43)

Olivier Cochard (olivier) · g202508_3
sysutils/edk2: fix network boot on bhyve

NetworkPkg's DxeNetLib needs EFI_RNG_PROTOCOL, and the Bhyve build's
only producer is VirtioRngDxe, which never binds since bhyve has no
virtio-rng device. RngDxe uses RDRAND instead and needs no device.
TcpDxe depexes gEfiHash2ServiceBindingProtocolGuid, so add
Hash2DxeCrypto too; without TcpDxe there is no HttpServiceBinding.
Also enable HTTP boot.

This recommits 3fcead9dc69a ("sysutils/edk2: fix network boot on bhyve"),
which also contained three unrelated patch files.

PR:		298499
Approved by:	manu
Sponsored by:	Netflix
0e7554170a
Olivier Cochard (olivier) · g202508_2
Revert "sysutils/edk2: fix network boot on bhyve"

This reverts commit 3fcead9dc69a1fb01bf4200ce3b079e942b57f39.

Wrongly added non-related files to previous commit.
d6250b82ec
Olivier Cochard (olivier) · g202508_3
sysutils/edk2: fix network boot on bhyve

NetworkPkg's DxeNetLib needs EFI_RNG_PROTOCOL, and the Bhyve build's
only producer is VirtioRngDxe, which never binds since bhyve has no
virtio-rng device. RngDxe uses RDRAND instead and needs no device.
TcpDxe depexes gEfiHash2ServiceBindingProtocolGuid, so add
Hash2DxeCrypto too; without TcpDxe there is no HttpServiceBinding.
Also enable HTTP boot.

PR:		298499
Approved by:	manu
Sponsored by:	Netflix
3fcead9dc6
Michael Osipov (michaelo) · g202508_2
sysutils/edk2: Reinstantiate binary aliases for ar and dtc

ar and dtc in base differ in function and capability form the ports
counterparts. Use from ports to make to build run again.

PR:		292544
MFH:		2026Q2
Differential Revision:	https://reviews.freebsd.org/D57279
d69944f5e1
Michael Osipov (michaelo) · g202508_1
sysutils/edk2: Depend on GCC at build time only

EDK2 produces self-contained binary runtime data which do not require GCC at
runtime, but only at build time.

Reviewed by:	fuz
MFH:		2026Q2
Differential Revision:	https://reviews.freebsd.org/D57187
64e6ea052e
Robert Clausecker (fuz) · g202508
sysutils/edk2: update to 2025008

Patch to update EDK2 OVMF firmware package used in bhyve and some ARM
platforms from 2023 to 2025 stable release. New submodules added in
GH_TUPLE, some script for build has been moved to a bash subshell.

BHYVE notices: tiny boot speedup, a bug with crashing on CPU sensor
wmsr from HWiNFO has stopped occurring, a bug with glibc apps crashing
in Linux VMs has stopped occurring, a crash on memtest86+ with more
than 1 vCPU has stopped occurring.

No new bugs seem to have surfaced.

PR:		285554
Tested by:	novel
MFH:		2025Q4
bafbff663b
Tijl Coosemans (tijl) · g202308_5
Mk/bsd.commands.mk: Use absolute path to define GMAKE

Same as BSDMAKE variable.  It is needed by some ports.

Some ports needed fixes:
- devel/rcs57: Regenerate configure with newer autoconf so it can deal
  with MAKE set to an absolute path.  While here fix issues with
  (un)escaping double quotes.  The warnings about this were in
  WRKSRC/src/conf.err.
- lang/gnu-cobol: Patch configure.ac so the MAKE environment variable
  can contain an absolute path, and define MAKE before it is used in
  AM_INIT_AUTOMAKE.  Remove post-patch patching of configure.  It appears
  to have been fixed upstream.
- math/unuran: Remove post-patch, fixed upstream.
- net-mgmt/kismet: Fix post-patch.

PR:		283534
Exp-run by:	antoine
624b8729fc
Li-Wen Hsu (lwhsu) · g202308_5
sysutils/edk2: Fix WWW
df6c02d890
Corvin Köhne (corvink) · g202308_5
sysutils/edk2: make bhyve's bootorder feature work

Bhyve supports a bootindex property for bootable devices. When adding it
to at least one device, bhyve creates a bootorder and passes it over the
Qemu FwCfg interface to the guest. The guest firmware has to pick up the
FwCfg file and has to apply the bootorder. Otherwise, the bootindex
property won't have any effect. Recently, a commit was merged by EDKII
to support that feature and we can simply cherry-pick it.

PR:			279720
Reviewed by:		manu
Approved by:		manu
Sponsored by:		Beckhoff Automation GmbH & Co. KG
Differential Revision:	https://reviews.freebsd.org/D45768
54eaea1ccd
Corvin Köhne (corvink) · g202308_4
sysutils/edk2: set IO port range properly for bhyve

Bhyve uses an io port range of [ 0x2000, 0x10000 ] [1]. At the moment,
EDKII is using a subset of this range [ 0xC000, 0x10000 ] [2]. Even
though the EDKII range doesn't exceed the bhyve range, it's causing
issues on some guests like OpenBSD. We don't know why it's causing
issues yet. However, using the same IO port range in EDKII fixes the
issue.

[1] https://github.com/freebsd/freebsd-src/blob/82ea0132c8b17a7a6067c8a36c6434e587ede6de/usr.sbin/bhyve/pci_emul.c#L133-L134
[2] https://github.com/tianocore/edk2/blob/fb044b7fe893a4545995bfe2701fd38e593355d9/OvmfPkg/Bhyve/PlatformPei/Platform.c#L156-L157

PR:			274389
Reviewed by:		manu, markj
Approved by:		manu
Sponsored by:		Beckhoff Automation GmbH & Co. KG
Differential Revision:	https://reviews.freebsd.org/D42627
231c5bc3a4
Corvin Köhne (corvink) · g202308_3
sysutils/edk2: enable TPM on bhyve

bhyve gained support for TPM emulation in the upcoming FreeBSD 14.0. The
firmware has to setup the TPM to make it useable for the OS.

Reviewed by:		manu
Approved by:		manu
Sponsored by:		Beckhoff Automation GmbH & Co. KG
Differential Revision:	https://reviews.freebsd.org/D41868
37e614b16c
Corvin Köhne (corvink) · g202308_2
sysutils/edk2: enable secure boot on bhyve

Everything is ready in edk2 for secure boot. To make use of secure boot
you have to boot into an EFI shell and install your keys. Booting an EFI
shell can be done by starting bhyve without any image attached to it.
More information on how to generate and install keys can be found in the
ACRN documentation [1].

Note that that secure boot capable UEFI implementation is required to
meet the Windows 11 requirements.

[1] https://projectacrn.github.io/3.2/tutorials/waag-secure-boot.html

Reviewed by:		manu
Approved by:		manu
Sponsored by:		Beckhoff Automation GmbH & Co. KG
Differential Revision:	https://reviews.freebsd.org/D41869
46375fd002
Corvin Köhne (corvink) · g202308_1
OvmfPkg/Bhyve: don't exit early if RSDP is not found in memory

If OVMF fails to find the RSDP in memory, it should fall back installing
the statically provided ACPI tables.

Signed-off-by: Corvin Köhne <corvink@FreeBSD.org>

PR:			273560
Reviewed by:		madpilot, manu
Approved by:		manu
Fixes:			8097dda40a03b8a27a1edf1f31a8af0455a52baf ("sysutils/edk2: update to 202308")
Sponsored by:		Beckhoff Automation GmbH & Co. KG
Differential Revision:	https://reviews.freebsd.org/D41769
d64f4b43b1
Emmanuel Vadot (manu) · g202308
sysutils/edk2: Fix distinfo

Regenerate distinfo with the correct short hashes.

Fixes:	8097dda40a03 ("sysutils/edk2: update to 202308")
Sponsored by:	Beckhoff Automation GmbH & Co. KG
PR:	273507
e37ff92fbb
Corvin Köhne (corvink) · g202308
sysutils/edk2: update to 202308

Reviewed by:		manu
Approved by:		manu
Sponsored by:		Beckhoff Automation GmbH & Co. KG
Differential Revision:	https://reviews.freebsd.org/D41631
8097dda40a
Rene Ladan (rene) · g202202_10
all: remove explicit versions in USES=python for "3.x+"

The logic in USES=python will automatically convert this to 3.8+ by
itself.

Adjust two ports that only had Python 3.7 mentioned but build fine
on Python 3.8 too.

finance/quickfix: mark BROKEN with PYTHON

libtool: compile:  c++ -DHAVE_CONFIG_H -I. -I../.. -I -I. -I.. -I../.. -I../C++ -DLIBICONV_PLUG -DPYTHON_MAJOR_VERSION=3 -Wno-unused-variable -Wno-maybe-uninitialized -O2 -pipe -DLIBICONV_PLUG -fstack-protector-strong -fno-strict-aliasing -DLIBICONV_PLUG -Wall -ansi -Wno-unused-command-line-argument -Wpointer-arith -Wwrite-strings -Wno-overloaded-virtual -Wno-deprecated-declarations -Wno-deprecated -std=c++0x -MT _quickfix_la-QuickfixPython.lo -MD -MP -MF .deps/_quickfix_la-QuickfixPython.Tpo -c QuickfixPython.cpp  -fPIC -DPIC -o .libs/_quickfix_la-QuickfixPython.o
warning: unknown warning option '-Wno-maybe-uninitialized'; did you mean '-Wno-uninitialized'? [-Wunknown-warning-option]
QuickfixPython.cpp:175:11: fatal error: 'Python.h' file not found
          ^~~~~~~~~~
1 warning and 1 error generated.

Reviewed by:	portmgr, vishwin, yuri
Differential Revision:	<https://reviews.freebsd.org/D40568>
3d9a815d9c
Gerald Pfeifer (gerald) · g202202_10
*: Bump PORTREVISIONs for math/mpc update to 1.3.1
8d3e020ed0
Emmanuel Vadot (manu) · g202202_2
sysutils/edk2: Enable IPV6

PR:	270631
Sponsored by:	Beckhoff Automation GmbH & Co. KG
b9d5e50016
Lorenzo Salvadore (salvadore) · g202202_1
sysutils/edk2: Fix build on aarch64

Build on aarch64 was failing with the following error:

ld-elf.so.1: /lib/libgcc_s.so.1: version GCC_4.5.0 required by
/usr/local/lib/gcc11/libstdc++.so.6 not found

Fix by using /usr/local/lib/gcc*/libgcc_s.so.1 instead.

While here, also define WWW variable.

PR:		266404
Approved by:	imp (uboot)
819bf69c15
Lorenzo Salvadore (salvadore) · g202202_1
sysutils/edk2: Fix build with GCC 12

- Backport two upstreamed patches.
- Fix ar path.

While here, pet portlint.

PR:		263543
Reported by:	exp-run (antoine)
Approved by:	manu
675ef8421c
Emmanuel Vadot (manu) · g202202_1
sysutils/edk2@qemu_i386: Fix build depends

nasm is also needed for qemu_i386

Fixes:	177204e319 ("sysutils/edk2: Add qemu_x64 and qemu_i386 as new FLAVORs of edk2")
Reported by:	pkg-fallout
Sponsored by:	Beckhoff Automation GmbH & Co. KG
0506877479
Rebecca Cran (bcran) · g202202_1
sysutils/edk2: Add qemu_x64 and qemu_i386 as new FLAVORs of edk2

Instead of having a separate sysutils/uefi-edk2-qemu port, add qemu_x64
and qemu_i386 as FLAVORs of sysutils/edk2 and delete sysutils/uefi-edk2-qemu.

Differential Revision: https://reviews.freebsd.org/D35408
Approved by: manu
177204e319
Emmanuel Vadot (manu) · g202202_1
sysutils/edk2@bhyve: Fix main firmware

EDK2 produce multiple files for the bhyve flavor, _CODE and _DATA
The PLAT_RESULT is just a concat of both.
But bhyve doesn't support having only one file.
When it was its own port we just install the _CODE file as the main file
instead of using the concat one generated during edk2 build.
For this port we need to use the main PLAT_RESULT files for all flavors
except bhyve so add a quirks in the install phase that just replace the main
file with the _CODE one.
Thanks to Corvin Köhne <CorvinK@beckhoff.com> for helping me understanding
the issue.

Fixes:		2e6a6ccd15 ("sysutils/edk2: Add bhyve as a new FLAVOR of edk2")
Sponsored by:	Beckhoff Automation GmbH & Co. KG
PR:		264338
3023881d2e
Rebecca Cran (bcran) · g202202
sysutils/edk2: Add bhyve as a new FLAVOR of edk2

Instead of having a separate sysutils/uefi-edk2-bhyve port, add bhyve
as a FLAVOR of sysutils/edk2 and delete sysutils/uefi-edk2-bhyve.

To support existing users who depend on firmware in
/usr/local/share/uefi-firmware create compatibility symlinks.

Update sysutils/bhyve-firmware to depend on edk2@bhyve.

Differential Revision: https://reviews.freebsd.org/D35148
Reviewed by: manu
Approved by: manu
2e6a6ccd15
Emmanuel Vadot (manu) · g202202
sysutils/edk2: Remove default FLAVOR

THis makes make clean clean all the flavors by default.
3e971e9bf5
Emmanuel Vadot (manu) · g202202
sysutils/edk2: Update to stable202202

Release notes: https://github.com/tianocore/edk2/releases/tag/edk2-stable202202
Release notes: https://github.com/tianocore/edk2/releases/tag/edk2-stable202111
Release notes: https://github.com/tianocore/edk2/releases/tag/edk2-stable202108
Release notes: https://github.com/tianocore/edk2/releases/tag/edk2-stable202105
7d47e1f297
Emmanuel Vadot (manu) · g202102
sysutils/edk2: Remove aarch64-none-elf-gcc on aarch64

We can use the native gcc (from USE_GCC) to build the ports so don't
add another build dep.
dfd3f7e23b
Emmanuel Vadot (manu) · g202102
sysutils/edk2: Mark the xen flavor as amd64 only

Xen flavors needs a gcc that can compile amd64 code (obviously) which
we don't really have in ports. Also there isn't much sense to build something
amd64 only on other arches. The inverse isn't true as bootstraping arm64 boards
from amd64 is common.

Reported by:  diizzy
cb4a79442c
Alexey Dokuchaev (danfe) · g202102
Style: improve ONLY_FOR_ARCHS_REASON (grammar, markup, etc.)

ONLY_FOR_ARCHS_REASON is used as part of the sentence and thus should
start with lower-case letter and not end with a period which is added
by the framework, similar to other knobs like BROKEN, IGNORE, et al.

While here, remove needless quoting, add missing Oxford comma, expand
contractions and jargonisms, use correct spelling for proper names.
61b6613393
Stefan Eßer (se) · g202102
sysutils/edk2: Add CPE information

Approved by:	portmgr (blanket)
12bc458a7a
Emmanuel Vadot (manu) · g202102
sysutils/edk2: Reorder FLAVORS

Put the default one (macchiatobin) at the first place otherwise poudriere
keeps rebuilding the package :

Deleting edk2-macchiatobin-g202102.pkg: stale package: unwanted origin sysutils/edk2@macchiatobin
e533c7117f
Andrew Turner (andrew) · g202102
sysutils/edk2: Add fvp support

This is used on the Arm Models (simulators)

Reviewed by:	manu
Approved by:	manu
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D31277
d7df5341db
Roger Pau Monné (royger) · g202102
sysutils/xen-tools: fix build on FreeBSD 12

QEMU Inter-VM shared memory device (ivshmem) depends on eventfd and
will only be built on FreeBSD versions > 12.

The fix is picked up from the QEMU port.

Approved by: bapt (implicit)
97632df2b3
Roger Pau Monné (royger) · g202102
sysutils/edk2: update to 202102

This also requires bumping the versions of some submodules and the
platform repositories.

Reviewed by: manu
Approved by: manu
Differential revision: https://reviews.freebsd.org/D30329
ef0c9c2a79
Roger Pau Monné (royger) · g202005
sysutils/edk2: use default gcc

Builds fine with the default gcc version.

Reviewed by: manu
Approved by: manu
Differential revision: https://reviews.freebsd.org/D30328
998bc21597
Emmanuel Vadot (manu) · g202005
sysutils/edk2: Rename xen flavor to xen_x64

We might want to have other flavor of this for other xen
arches at one point.

Reviewed by:	royger
Differential Revision:	https://reviews.freebsd.org/D30278
91fcb7ade6
Emmanuel Vadot (manu) · g202005
sysutils/edk2: Restrict building on aarch64 and amd64

The port only provides firmwares for those arch so it doesn't make sense to
build them for other arch.
If one day people wants to bootstrap an aarch64 image from a risc-v board
we will reconsider this change.
d80d28ff5b
Roger Pau Monné (royger) · g202005
sysutils/edk2: add Xen platform

As part of this make the gcc aarch64 dependency conditional to
building a firmware for that architecture, and make the nasm package a
build dependency for the X64 (amd64) targets.

Sponsored by: Citrix Systems R&D
Reviewed by: manu
Approved by: manu
Differential revision: https://reviews.freebsd.org/D30225
565eb7e544
Emmanuel Vadot (manu) · g202005
sysutils/edk2: Set maintainer to uboot@

Nobody should ever own this port so set the uboot list as the maintainer.
Even if it's not uboot this port is a flavored port for edk2 targeting
arm64 boards (for now) so uboot@ is the closest things that we have.
d945bde259
Mathieu Arnold (mat) · g202005
One more small cleanup, forgotten yesterday. Reported by:	lwhsu
cf118ccf87
Mathieu Arnold (mat) · g202005
Remove # $FreeBSD$ from Makefiles.
305f148f48
Mark Linimon (linimon) · g202005
Restrict only to architectures that the code claims to support:

Python/TargetTool/TargetTool.py:  help="ARCHS is one of list: IA32, X64, ARM, AARCH64 or EBC, which replaces target.txt's TARGET_ARCH definition. To specify more archs, please repeat this option."
  Python/build/buildoptions.py:     help="ARCHS is one of list: IA32, X64, ARM, AARCH64, RISCV64 or EBC, which overrides target.txt's TARGET_ARCH definition. To specify more archs, please repeat this option."

See also: BaseTools/Source/C/GNUmakefile.

Result from attempt on powerpc64:

  Attempting to detect HOST_ARCH from 'uname -m': powerpc
  Could not detected HOST_ARCH from uname results

Approved by:	portmgr (tier-2 blanket)
b8072cb547
Emmanuel Vadot (manu) · g202005
sysutils/edk2: Add new port

EDK2 is a modern, feature-rich, cross-platform firmware development
environment for the UEFI and PI specifications from www.uefi.org.

The port currently support 3 flavors: macchiatobin, rpi3 and rpi4.
c4a15033e2