[HIGH] Patch kata-containers-cc for CVE-2025-5791 and [MEDIUM] CVE-2025-4574 - #14238
[HIGH] Patch kata-containers-cc for CVE-2025-5791 and [MEDIUM] CVE-2025-4574#14238archana25-ms wants to merge 3 commits into
Conversation
microsoft-github-policy-service
Bot
added
Packaging
fasttrack/3.0
|
/azurepipelines run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azurepipelines run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azurepipelines run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
| Distribution: Azure Linux | ||
| Source0: https://github.com/microsoft/kata-containers/archive/refs/tags/%{version}.tar.gz#/%{sourceName}-%{version}.tar.gz | ||
| Source1: %{sourceName}-%{version}-cargo.tar.gz | ||
| Patch0: CVE-2025-4574.patch |
There was a problem hiding this comment.
@ms-mahuber this is for kata-containers-cc, which will stay at 3.15 for the time being
There was a problem hiding this comment.
I thought the policy is to fix CVEs at source level and increment the sources, rather than applying patch files on SPEC level.
|
Can we please share build IDs for end-to-end tests in AKS? |
7100e50 to
dd5cd88
Compare
5f59ca5 to
b8a84d8
Compare
| @@ -0,0 +1,53 @@ | |||
| From ff0fc156e62412d2cde3790d58fd121e48215953 Mon Sep 17 00:00:00 2001 | |||
There was a problem hiding this comment.
This CVE fix should be contributed to our fork. How would a fix in our fork look like?
There was a problem hiding this comment.
Fix from upstream for runk: https://github.com/kata-containers/kata-containers/pull/11411/files
There was a problem hiding this comment.
For the following packages:
- kata: Upgrade to 3.18.0 will not contain utarfs anymore, so we should apply the upgrade
- kata-cc: We should amend the 3.15.0 release - we should follow the same approach for utarfs as for runk https://github.com/kata-containers/kata-containers/pull/11411/files where we adjust the reference to the users crate (to uzers)
There was a problem hiding this comment.
@ms-mahuber the users crate is a dependency pulled in from the direct dependency on fuser in Cargo.toml.
The fuser version in sources is 0.12.0. The 0.13.0 release removes dependency on users.
| @@ -0,0 +1,35 @@ | |||
| From 804b30dde9c5e95b794e08bd01c26464ede4933c Mon Sep 17 00:00:00 2001 | |||
There was a problem hiding this comment.
This should be fixed upstream first if not yet done, then we can backport this into our fork or consume the fix through rebasing our sources against a new release
There was a problem hiding this comment.
Looks like this is already fixed upstream resp. in our fork. For:
- kata: The 3.18.0 release uses crossbeam-channel with 0.5.15
- kata-cc: The 3.15.0 release still uses crossbeam-channel 0.5.14. Here, we should extend the release/3.15.0 branch to update the rust crate reference
|
Will close this PR. @ms-mahuber @Redent0r |
|
merged and fixed at #17761 |
6 participants
Merge Checklist
All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)
*-staticsubpackages, etc.) have had theirReleasetag incremented../cgmanifest.json,./toolkit/scripts/toolchain/cgmanifest.json,.github/workflows/cgmanifest.json)./LICENSES-AND-NOTICES/SPECS/data/licenses.json,./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md,./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)*.signatures.jsonfilessudo make go-tidy-allandsudo make go-test-coveragepassSummary
What does the PR accomplish, why was it needed?
Patch kata-containers-cc for CVE-2025-5791 and CVE-2025-4574
CVE-2025-4574
CVE-2025-5791
Change Log
Does this affect the toolchain?
NO
Associated issues
Links to CVEs
Test Methodology
kata-containers-cc-3.15.0.aks0-3.azl3.src.rpm.log