How to verify that the CVE-2023-39902 issue has been fixed?

[ZongYue]

By using NXP U-Boot version lf-5.15.5-1.0.0 on the i.MX8MP platform and referencing the patch for CVE-2023-39902 (U-Boot Secondary Program Loader Authentication Vulnerability - CVE-2023-39902 ) from NXP version lf-6.12.3-1.0.0.

This modification appears to address two issues:

1. Stack overflow caused by excessively long bootargs

2. U-Boot Secondary Program Loader (SPL) authentication vulnerability

How can we verify that these issues have been successfully fixed in the modified lf-5.15.5-1.0.0 U-Boot?

[ZongYue]

Hi @Harvey021 ,

Thank you for providing the patch file for version lf-5.15.5-1.0.0.

[Harvey021 · Accepted solution]

Will send you system email with bootport patchs for the version of BSP.

Regards

Harvey