Critical bug in RTC code for a leap year

[Michał Żygowski]

Hi folks,

Another leap year, another problem with RTC in firmwares :) This time,
unfortunately, this kind of bugs hit coreboot.

I have issued a patch that fixes off-by-one error in the days count in
month for a leap year:
https://review.coreboot.org/c/coreboot/+/80790

It is quite critical, because depending on build date, it may revert to
some very old date, like January 2023 or even older (depending on how
long you run on current firmware). That said, the consequences are
enormous: from false-negative expired certificates, to problems with
filesystems, etc.

It is worth considering an emergency coreboot release, is it not?

Best regards,

[Matt DeVillier]

On Thu, Feb 29, 2024 at 4:59 AM Michał Żygowski 
wrote:
> Hi folks,
>
> Another leap year, another problem with RTC in firmwares :) This time,
> unfortunately, this kind of bugs hit coreboot.
>
> I have issued a patch that fixes off-by-one error in the days count in
> month for a leap year:
> https://review.coreboot.org/c/coreboot/+/80790
>
> It is quite critical, because depending on build date, it may revert to
> some very old date, like January 2023 or even older (depending on how
> long you run on current firmware). That said, the consequences are
> enormous: from false-negative expired certificates, to problems with
> filesystems, etc.
>
> It is worth considering an emergency coreboot release, is it not?

I suppose we could CP to the 2402 branch and tag a 2402.1 release if
there's sufficient desire for a tagged release with the fix
> Best regards,