From 4bd628ce9844c04623ade7b875efaa19a6b57b35 Mon Sep 17 00:00:00 2001 From: Mikey Strauss Date: Fri, 31 Jul 2026 16:29:59 +0300 Subject: [PATCH] SecurityPkg/DeviceSecurity: Update libspdm submodule to 3.8.2 The libspdm submodule was pinned at 3.7.0 (2025-04-03), three releases behind upstream 3.8.2 (2026-04-03). libspdm processes untrusted responder (device) data in the SPDM device attestation path, so tracking upstream keeps that parsing current with fixes and hardening. Two responder-side advisories were resolved between 3.7.0 and 3.8.2: - GHSA-j54w-759w-xj3m: out-of-bounds write in GET_CSR handling. - GHSA-m4wc-xmvg-369f: integer overflow / out-of-bounds read in GET_MEASUREMENT_EXTENSION_LOG handling. Both are responder-side. edk2 links SpdmRequesterLib (it acts as the SPDM Requester that verifies an untrusted device Responder), so these responder handlers are not built into edk2 images; this update is defense-in-depth rather than a fix for a path reachable in edk2 today. The libspdm sources referenced by the SpdmLib INFs are unchanged in 3.8.2 (the only additions are the optional ENDPOINT_INFO capability sources, which edk2 does not enable), so no INF change is required. Cc: Jiewen Yao Cc: Chris Fernald Signed-off-by: Mikey Strauss --- SecurityPkg/DeviceSecurity/SpdmLib/libspdm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SecurityPkg/DeviceSecurity/SpdmLib/libspdm b/SecurityPkg/DeviceSecurity/SpdmLib/libspdm index 1be116c7b7..f55cf6d48e 160000 --- a/SecurityPkg/DeviceSecurity/SpdmLib/libspdm +++ b/SecurityPkg/DeviceSecurity/SpdmLib/libspdm @@ -1 +1 @@ -Subproject commit 1be116c7b7713fa9003e1bd53b53a34758549eb9 +Subproject commit f55cf6d48ec69b4ac60a63903e9c6a2cb0fd155d