diff --git a/SPECS/kata-containers-cc/CVE-2026-43871.patch b/SPECS/kata-containers-cc/CVE-2026-43871.patch new file mode 100644 index 00000000000..2c44490dfb1 --- /dev/null +++ b/SPECS/kata-containers-cc/CVE-2026-43871.patch @@ -0,0 +1,51 @@ +From 30a34feb076d3f7980a3ee7498e3c9da25382368 Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Mon, 3 Aug 2026 18:23:26 +0000 +Subject: [PATCH] Add varint byte-count limit to compact protocol reader + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://github.com/apache/thrift/commit/d5152211af61f850ec393604316804096dd4632e.patch +--- + .../thrift/lib/go/thrift/compact_protocol.go | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go +index a49225d..3e1988c 100644 +--- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go ++++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go +@@ -754,25 +754,28 @@ func (p *TCompactProtocol) readVarint32() (int32, error) { + return int32(v), err + } + ++// maxVarint64Bytes is the maximum wire size of a varint-encoded 64-bit integer: ++// ceil(64/7) = 10 bytes, matching the protobuf wire-format specification. ++const maxVarint64Bytes = 10 ++ + // Read an i64 from the wire as a proper varint. The MSB of each byte is set + // if there is another byte to follow. This can read up to 10 bytes. + func (p *TCompactProtocol) readVarint64() (int64, error) { + shift := uint(0) + result := int64(0) +- for { ++ for rsize := 0; rsize < maxVarint64Bytes; rsize++ { + b, err := p.readByteDirect() + if err != nil { + return 0, err + } + result |= int64(b&0x7f) << shift + if (b & 0x80) != 0x80 { +- break ++ return result, nil + } + shift += 7 + } +- return result, nil ++ return 0, NewTProtocolExceptionWithType(INVALID_DATA, errors.New("variable-length int over 10 bytes")) + } +- + // Read a byte, unlike ReadByte that reads Thrift-byte that is i8. + func (p *TCompactProtocol) readByteDirect() (byte, error) { + return p.trans.ReadByte() +-- +2.45.4 + diff --git a/SPECS/kata-containers-cc/CVE-2026-48586.patch b/SPECS/kata-containers-cc/CVE-2026-48586.patch new file mode 100644 index 00000000000..776db21de5e --- /dev/null +++ b/SPECS/kata-containers-cc/CVE-2026-48586.patch @@ -0,0 +1,76 @@ +From 5fabe062a1881923a08032fd5cf53e25f94e5c6b Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Mon, 3 Aug 2026 18:23:10 +0000 +Subject: [PATCH] Add decompressed data size limit to TZlibTransport Client: go + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://github.com/apache/thrift/commit/aed9eb012c76d3d59618cbdc225c65f013ce3ab0.patch +--- + .../thrift/lib/go/thrift/zlib_transport.go | 23 +++++++++++++++---- + 1 file changed, 19 insertions(+), 4 deletions(-) + +diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport.go +index 259943a6..328c7049 100644 +--- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport.go ++++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport.go +@@ -22,6 +22,7 @@ package thrift + import ( + "compress/zlib" + "context" ++ "fmt" + "io" + ) + +@@ -33,9 +34,11 @@ type TZlibTransportFactory struct { + + // TZlibTransport is a TTransport implementation that makes use of zlib compression. + type TZlibTransport struct { +- reader io.ReadCloser +- transport TTransport +- writer *zlib.Writer ++ reader io.ReadCloser ++ transport TTransport ++ writer *zlib.Writer ++ conf *TConfiguration ++ bytesRead int64 + } + + // GetTransport constructs a new instance of NewTZlibTransport +@@ -78,6 +81,7 @@ func NewTZlibTransport(trans TTransport, level int) (*TZlibTransport, error) { + // Close closes the reader and writer (flushing any unwritten data) and closes + // the underlying transport. + func (z *TZlibTransport) Close() error { ++ z.bytesRead = 0 + if z.reader != nil { + if err := z.reader.Close(); err != nil { + return err +@@ -116,7 +120,17 @@ func (z *TZlibTransport) Read(p []byte) (int, error) { + z.reader = r + } + +- return z.reader.Read(p) ++ n, err := z.reader.Read(p) ++ if n > 0 { ++ z.bytesRead += int64(n) ++ if maxSize := int64(z.conf.GetMaxMessageSize()); z.bytesRead > maxSize { ++ return n, NewTProtocolExceptionWithType( ++ SIZE_LIMIT, ++ fmt.Errorf("decompressed size exceeded limit of %d bytes", maxSize), ++ ) ++ } ++ } ++ return n, err + } + + // RemainingBytes returns the size in bytes of the data that is still to be +@@ -131,6 +145,7 @@ func (z *TZlibTransport) Write(p []byte) (int, error) { + + // SetTConfiguration implements TConfigurationSetter for propagation. + func (z *TZlibTransport) SetTConfiguration(conf *TConfiguration) { ++ z.conf = conf + PropagateTConfiguration(z.transport, conf) + } + +-- +2.45.4 + diff --git a/SPECS/kata-containers-cc/CVE-2026-55969.patch b/SPECS/kata-containers-cc/CVE-2026-55969.patch new file mode 100644 index 00000000000..6ae89193302 --- /dev/null +++ b/SPECS/kata-containers-cc/CVE-2026-55969.patch @@ -0,0 +1,326 @@ +From 37650feef9aa3d6d6d6bc6067b2212e774be6a85 Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Mon, 3 Aug 2026 18:24:20 +0000 +Subject: [PATCH] widen container size precheck to 64-bit in go protocols + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://github.com/apache/thrift/commit/ed643a86d4fec8d94dbff9048ad5fda67fcca473.patch +--- + .../thrift/lib/go/thrift/binary_protocol.go | 53 ++++++++++++++-- + .../thrift/lib/go/thrift/compact_protocol.go | 50 ++++++++++++++++ + .../thrift/lib/go/thrift/configuration.go | 23 +++++++ + .../thrift/lib/go/thrift/json_protocol.go | 60 +++++++++++++++++-- + .../lib/go/thrift/simple_json_protocol.go | 2 + + 5 files changed, 177 insertions(+), 11 deletions(-) + +diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/binary_protocol.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/binary_protocol.go +index 45c880d3..2137cec1 100644 +--- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/binary_protocol.go ++++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/binary_protocol.go +@@ -354,8 +354,9 @@ func (p *TBinaryProtocol) ReadMapBegin(ctx context.Context) (kType, vType TType, + err = NewTProtocolException(e) + return + } +- if size32 < 0 { +- err = invalidDataLength ++ minElemSize := p.getMinSerializedSize(kType) + p.getMinSerializedSize(vType) ++ err = checkContainerSizeForProtocol(int64(size32), minElemSize, p.cfg) ++ if err != nil { + return + } + size = int(size32) +@@ -378,8 +379,9 @@ func (p *TBinaryProtocol) ReadListBegin(ctx context.Context) (elemType TType, si + err = NewTProtocolException(e) + return + } +- if size32 < 0 { +- err = invalidDataLength ++ minElemSize := p.getMinSerializedSize(elemType) ++ err = checkContainerSizeForProtocol(int64(size32), minElemSize, p.cfg) ++ if err != nil { + return + } + size = int(size32) +@@ -403,8 +405,9 @@ func (p *TBinaryProtocol) ReadSetBegin(ctx context.Context) (elemType TType, siz + err = NewTProtocolException(e) + return + } +- if size32 < 0 { +- err = invalidDataLength ++ minElemSize := p.getMinSerializedSize(elemType) ++ err = checkContainerSizeForProtocol(int64(size32), minElemSize, p.cfg) ++ if err != nil { + return + } + size = int(size32) +@@ -540,6 +543,44 @@ var ( + _ TConfigurationSetter = (*TBinaryProtocol)(nil) + ) + ++// Return the minimum number of bytes a type will consume on the wire ++func (p *TBinaryProtocol) getMinSerializedSize(ttype TType) int32 { ++ switch ttype { ++ case STOP: ++ return 1 // T_STOP needs to count itself ++ case VOID: ++ return 1 // T_VOID needs to count itself ++ case BOOL: ++ return 1 // sizeof(int8) ++ case BYTE: ++ return 1 // sizeof(int8) ++ case DOUBLE: ++ return 8 // sizeof(double) ++ case I16: ++ return 2 // sizeof(short) ++ case I32: ++ return 4 // sizeof(int) ++ case I64: ++ return 8 // sizeof(long) ++ case STRING: ++ return 4 // string length ++ case STRUCT: ++ return 1 // empty struct needs at least 1 byte for the T_STOP ++ case MAP: ++ return 4 // element count ++ case SET: ++ return 4 // element count ++ case LIST: ++ return 4 // element count ++ case UTF8: ++ return 4 // fixed-width 4-byte string length prefix ++ case UTF16: ++ return 4 // fixed-width 4-byte string length prefix ++ default: ++ return 1 // unknown type ++ } ++} ++ + // This function is shared between TBinaryProtocol and TCompactProtocol. + // + // It tries to read size bytes from trans, in a way that prevents large +diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go +index 32c269dd..5a69d3ec 100644 +--- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go ++++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go +@@ -492,6 +492,12 @@ func (p *TCompactProtocol) ReadMapBegin(ctx context.Context) (keyType TType, val + } + keyType, _ = p.getTType(tCompactType(keyAndValueType >> 4)) + valueType, _ = p.getTType(tCompactType(keyAndValueType & 0xf)) ++ ++ minElemSize := p.getMinSerializedSize(keyType) + p.getMinSerializedSize(valueType) ++ err = checkContainerSizeForProtocol(int64(size32), minElemSize, p.cfg) ++ if err != nil { ++ return ++ } + return + } + +@@ -524,6 +530,12 @@ func (p *TCompactProtocol) ReadListBegin(ctx context.Context) (elemType TType, s + err = NewTProtocolException(e) + return + } ++ ++ minElemSize := p.getMinSerializedSize(elemType) ++ err = checkContainerSizeForProtocol(int64(size), minElemSize, p.cfg) ++ if err != nil { ++ return ++ } + return + } + +@@ -863,6 +875,44 @@ func (p *TCompactProtocol) SetTConfiguration(conf *TConfiguration) { + p.cfg = conf + } + ++// Return the minimum number of bytes a type will consume on the wire ++func (p *TCompactProtocol) getMinSerializedSize(ttype TType) int32 { ++ switch ttype { ++ case STOP: ++ return 1 // T_STOP needs to count itself ++ case VOID: ++ return 1 // T_VOID needs to count itself ++ case BOOL: ++ return 1 // sizeof(int8) ++ case BYTE: ++ return 1 // sizeof(int8) ++ case DOUBLE: ++ return 8 // uses PutUint64() which always writes 8 bytes ++ case I16: ++ return 1 // zigzag ++ case I32: ++ return 1 // zigzag ++ case I64: ++ return 1 // zigzag ++ case STRING: ++ return 1 // string length ++ case STRUCT: ++ return 1 // empty struct needs at least 1 byte for the T_STOP ++ case MAP: ++ return 1 // element count ++ case SET: ++ return 1 // element count ++ case LIST: ++ return 1 // element count ++ case UTF8: ++ return 1 // minimum one-byte varint string length ++ case UTF16: ++ return 1 // minimum one-byte varint string length ++ default: ++ return 1 // unknown type ++ } ++} ++ + var ( + _ TConfigurationSetter = (*TCompactProtocolFactory)(nil) + _ TConfigurationSetter = (*TCompactProtocol)(nil) +diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/configuration.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/configuration.go +index 454d9f37..376dae9f 100644 +--- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/configuration.go ++++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/configuration.go +@@ -22,6 +22,7 @@ package thrift + import ( + "crypto/tls" + "fmt" ++ "math" + "time" + ) + +@@ -318,6 +319,28 @@ func checkSizeForProtocol(size int32, cfg *TConfiguration) error { + return nil + } + ++// checkContainerSizeForProtocol validates the minimum on-wire size of a ++// container with the given wire-supplied element count, where each element ++// occupies at least minElemSize bytes. The count is range-checked and the ++// product is computed in 64-bit arithmetic, so the value handed to ++// checkSizeForProtocol always stays within int32 range. ++func checkContainerSizeForProtocol(size int64, minElemSize int32, cfg *TConfiguration) error { ++ if size < 0 { ++ return NewTProtocolExceptionWithType( ++ NEGATIVE_SIZE, ++ fmt.Errorf("negative size: %d", size), ++ ) ++ } ++ totalMinSize := size * int64(minElemSize) ++ if totalMinSize > math.MaxInt32 { ++ return NewTProtocolExceptionWithType( ++ SIZE_LIMIT, ++ fmt.Errorf("size exceeded max allowed: %d", totalMinSize), ++ ) ++ } ++ return checkSizeForProtocol(int32(totalMinSize), cfg) ++} ++ + type tTransportFactoryConf struct { + delegate TTransportFactory + cfg *TConfiguration +diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/json_protocol.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/json_protocol.go +index 8e59d16c..f40af655 100644 +--- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/json_protocol.go ++++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/json_protocol.go +@@ -311,12 +311,18 @@ func (p *TJSONProtocol) ReadMapBegin(ctx context.Context) (keyType TType, valueT + } + + // read size +- iSize, e := p.ReadI64(ctx) +- if e != nil { +- return keyType, valueType, size, e ++ iSize, err := p.ReadI64(ctx) ++ if err != nil { ++ return keyType, valueType, size, err + } + size = int(iSize) + ++ minElemSize := p.getMinSerializedSize(keyType) + p.getMinSerializedSize(valueType) ++ err = checkContainerSizeForProtocol(iSize, minElemSize, p.cfg) ++ if err != nil { ++ return keyType, valueType, 0, err ++ } ++ + _, e = p.ParseObjectStart() + return keyType, valueType, size, e + } +@@ -506,9 +512,15 @@ func (p *TJSONProtocol) readElemListBegin() (elemType TType, size int, e error) + if err != nil { + return elemType, size, err + } +- nSize, _, err2 := p.ParseI64() ++ nSize, _, err := p.ParseI64() + size = int(nSize) +- return elemType, size, err2 ++ ++ minElemSize := p.getMinSerializedSize(elemType) ++ err = checkContainerSizeForProtocol(nSize, minElemSize, p.cfg) ++ if err != nil { ++ return elemType, 0, err ++ } ++ return elemType, size, nil + } + + func (p *TJSONProtocol) writeElemListBegin(elemType TType, size int) error { +@@ -588,4 +600,42 @@ func (p *TJSONProtocol) StringToTypeId(fieldType string) (TType, error) { + return TType(STOP), NewTProtocolExceptionWithType(INVALID_DATA, e) + } + ++// Return the minimum number of bytes a type will consume on the wire ++func (p *TJSONProtocol) getMinSerializedSize(ttype TType) int32 { ++ switch ttype { ++ case STOP: ++ return 1 // T_STOP needs to count itself ++ case VOID: ++ return 1 // T_VOID needs to count itself ++ case BOOL: ++ return 1 // written as int ++ case BYTE: ++ return 1 ++ case DOUBLE: ++ return 1 ++ case I16: ++ return 1 ++ case I32: ++ return 1 ++ case I64: ++ return 1 ++ case STRING: ++ return 2 // empty string ++ case STRUCT: ++ return 2 // empty struct ++ case MAP: ++ return 2 // empty map ++ case SET: ++ return 2 // empty set ++ case LIST: ++ return 2 // empty list ++ case UTF8: ++ return 2 // empty utf8 ++ case UTF16: ++ return 2 // empty utf16 ++ default: ++ return 1 // unknown type ++ } ++} ++ + var _ TConfigurationSetter = (*TJSONProtocol)(nil) +diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/simple_json_protocol.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/simple_json_protocol.go +index d1a81545..f42aac04 100644 +--- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/simple_json_protocol.go ++++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/simple_json_protocol.go +@@ -97,6 +97,7 @@ var errEmptyJSONContextStack = NewTProtocolExceptionWithType(INVALID_DATA, error + type TSimpleJSONProtocol struct { + trans TTransport + ++ cfg *TConfiguration + parseContextStack jsonContextStack + dumpContext jsonContextStack + +@@ -1367,6 +1368,7 @@ func (p *TSimpleJSONProtocol) write(b []byte) (int, error) { + + // SetTConfiguration implements TConfigurationSetter for propagation. + func (p *TSimpleJSONProtocol) SetTConfiguration(conf *TConfiguration) { ++ p.cfg = conf + PropagateTConfiguration(p.trans, conf) + } + +-- +2.45.4 + diff --git a/SPECS/kata-containers-cc/kata-containers-cc.spec b/SPECS/kata-containers-cc/kata-containers-cc.spec index 4179deb48af..15168bb7232 100644 --- a/SPECS/kata-containers-cc/kata-containers-cc.spec +++ b/SPECS/kata-containers-cc/kata-containers-cc.spec @@ -3,7 +3,7 @@ Name: kata-containers-cc Version: 3.15.0.aks0 -Release: 16%{?dist} +Release: 17%{?dist} Summary: Kata Confidential Containers package developed for Confidential Containers on AKS License: ASL 2.0 URL: https://github.com/microsoft/kata-containers @@ -19,6 +19,9 @@ Patch4: CVE-2025-5791.patch Patch5: CVE-2025-4574.patch Patch6: CVE-2026-42250.patch Patch7: CVE-2026-56852.patch +Patch8: CVE-2026-43871.patch +Patch9: CVE-2026-48586.patch +Patch10: CVE-2026-55969.patch ExclusiveArch: x86_64 BuildRequires: azurelinux-release @@ -154,6 +157,9 @@ fi %{tools_pkg}/tools/osbuilder/node-builder/azure-linux/agent-install/usr/lib/systemd/system/kata-agent.service %changelog +* Mon Aug 03 2026 Azure Linux Security Servicing Account - 3.15.0.aks0-17 +- Patch for CVE-2026-55969, CVE-2026-48586, CVE-2026-43871 + * Mon Jul 27 2026 Azure Linux Security Servicing Account - 3.15.0.aks0-16 - Patch for CVE-2026-56852