* istoreos-22.03:
target/rk3568: add roceos k50s
target/rk3568: add roceos k50s official dts
target/x86: auto unload qed drivers
kernel: add QLogic QED drivers
target/rk35xx: format ota.sh
* istoreos-22.03:
rk3568: update k40pro official dts
target/rk35xx: add DG NAS LITE support (#1812)
target/rk3582: add eeprom support to radxa e52c dts
target/rk3588: radxa e52c supports OTA
* commit '4e1d1b7df0ce6fa96d7462dc883917682f428046': (75 commits)
OpenWrt v22.03.7: revert to branch defaults
OpenWrt v22.03.7: adjust config defaults
wolfssl: Update to version 5.7.2
ksmbd: Update to version 3.5.0
ksmbd: update to latest 3.4.8 release
wireless-regdb: Update to version 2024.07.04
mac80211: Update to version 5.15.162-1
ucode: add libjson-c/host dependency
hostapd: fix 11r defaults when using WPA
hostapd: fix 11r defaults when using SAE
dropbear: cherry-pick upstream patches
firmware: intel-microcode: update to 20240531
firmware: intel-microcode: update to 20240312
firmware: intel-microcode: update to 20231114
.gitignore: ignore link if target is included from feed
lua: fix CVE-2014-5461
wireless-regdb: update to 2024.05.08
mac80211: add missing config for third 160MHz width for 5GHz radio
mbedtls: Update to 2.28.8
kernel: bump 5.10 to 5.10.221
...
# Conflicts:
# .github/workflows/tools.yml
This fixes multiple security problems:
* [Medium] CVE-2024-1544
Potential ECDSA nonce side channel attack in versions of wolfSSL before 5.6.6 with wc_ecc_sign_hash calls.
* [Medium] CVE-2024-5288
A private key blinding operation, enabled by defining the macro WOLFSSL_BLIND_PRIVATE_KEY, was added to mitigate a potential row hammer attack on ECC operations.
* [Low] When parsing a provided maliciously crafted certificate directly using wolfSSL API, outside of a TLS connection, a certificate with an excessively large number of extensions could lead to a potential DoS.
* [Low] CVE-2024-5991
In the function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked.
* [Medium] CVE-2024-5814
A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection.
* [Medium] OCSP stapling version 2 response verification bypass issue when a crafted response of length 0 is received.
* [Medium] OCSP stapling version 2 revocation bypass with a retry of a TLS connection attempt.
Unset DISABLE_NLS to prevent setting the unsupported configuration
option --disable-nls which breaks the build now.
Link: https://github.com/openwrt/openwrt/pull/15948
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 3a0232ffd3)
