microsoft/mu_basecore v2025020002.1.2

v2025020002.1.2

Repository: microsoft/mu_basecore

Tag: v2025020002.1.2

Published: 2025-11-04T00:19:44Z

Prerelease: no

Release notes:

What's Changed

BaseTools: Update Brotli Compress to 1.2.0 @vineelko (#1555)

Change Details

Description

Update brotli from v1.0.9 to v1.2.0 https://github.com/google/brotli/releases/tag/v1.2.0

• [ ] Breaking change?
• Breaking change - Does this PR cause a break in build or boot behavior?
• Examples: Does it add a new library class or move a module to a different repo.
• [x] Impacts security?
• Security - Does this PR have a direct security impact?
• Fixes CVE-2025-6176 reported in brotli

Added explicit state validation in FindVariableEx() to skip variables with deleted state (0x3C) and only return valid variables @AnsenHuangMSFT (#1551)

Change Details

Description

Problem: The Variable PEIM's index table optimization search path incorrectly returns deleted variables instead of valid variables when duplicate variables exist with different states. This occurs when:

One variable has deleted state (VAR_IN_DELETED_TRANSITION & VAR_ADDED, value 0x3C) One variable has valid state (VAR_ADDED, value 0x3F) Both variables have the same name and GUID The function should prioritize and return the valid variable, but the index table search was returning the first match regardless of state validity.

Root Cause: In the FindVariableEx() index table traversal, the function was not properly validating variable states before returning a match. When CompareWithValidVariable() found a matching variable name and GUID, it would return immediately without checking if the variable state was valid (0x3F) or deleted (0x3C).

This issue only affects the index table optimization search path and does not impact the linear traversal search path. The Variable PEIM has two main search mechanisms:

Linear traversal search - Walks through the entire variable store checking each header sequentially. This path has correct state validation logic and is unaffected by this issue.

Index table optimization search - Uses a gEfiVariableIndexTableGuid HOB to quickly jump to variable locations. This optimization is only active when the platform produces this HOB. This is the path affected by the bug.

Solution: Added explicit state validation in FindVariableEx() to skip variables with deleted state (0x3C) and only return valid variables:

• [ ] Impacts functionality?
• [ ] Impacts security?
• [ ] Breaking change?
• [ ] Includes tests?
• [ ] Includes documentation?

How This Was Tested

Create variable with delete and valid in NVRAM. Call FindVariableEx() and check the variable address. It only return valid variable address

Integration Instructions

N/A

[CHERRY-PICK] NetworkPkg/SnpDxe: Fix Snp used uninitialized @eeshanl (#1554)

Change Details

Description

Ensures the Snp Structure is initialized as NULL.

cherry-picks back the fix from EDK2

For details on how to complete these options and their meaning refer to CONTRIBUTING.md.

• [ ] Impacts functionality?
• [ ] Impacts security?
• [ ] Breaking change?
• [ ] Includes tests?
• [ ] Includes documentation?

How This Was Tested

Tested on physical device

Integration Instructions

N/A

Full Changelog: https://github.com/microsoft/mu_basecore/compare/v2025020002.1.1...v2025020002.1.2