Skip to content

Commit 3e81626

Browse files
CBL-Mariner-BotPawelWMS
CBL-Mariner-Bot
and
PawelWMS
authored
[AUTO-CHERRYPICK] Patched moby-engine CVEs: 2024-23651 and 2024-23652. - branch main (#7854)
Co-authored-by: Pawel Winogrodzki <pawelwi@microsoft.com>
1 parent 8a68e5f commit 3e81626

3 files changed

Lines changed: 267 additions & 2 deletions

File tree

‎SPECS/moby-engine/CVE-2024-23651.patch‎

Lines changed: 220 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,220 @@
1+
diff --git a/vendor/github.com/moby/buildkit/executor/oci/spec.go b/vendor/github.com/moby/buildkit/executor/oci/spec.go
2+
index 8000310..0eb5d49 100644
3+
--- a/vendor/github.com/moby/buildkit/executor/oci/spec.go
4+
+++ b/vendor/github.com/moby/buildkit/executor/oci/spec.go
5+
@@ -2,7 +2,9 @@ package oci
6+
7+
import (
8+
"context"
9+
+ "os"
10+
"path"
11+
+ "strconv"
12+
"sync"
13+
14+
"github.com/containerd/containerd/containers"
15+
@@ -18,6 +20,7 @@ import (
16+
specs "github.com/opencontainers/runtime-spec/specs-go"
17+
"github.com/opencontainers/selinux/go-selinux"
18+
"github.com/pkg/errors"
19+
+ "golang.org/x/sys/unix"
20+
)
21+
22+
// ProcessMode configures PID namespaces
23+
@@ -145,6 +148,7 @@ func GenerateSpec(ctx context.Context, meta executor.Meta, mounts []executor.Mou
24+
type mountRef struct {
25+
mount mount.Mount
26+
unmount func() error
27+
+ subRefs map[string]mountRef
28+
}
29+
30+
type submounts struct {
31+
@@ -163,10 +167,17 @@ func (s *submounts) subMount(m mount.Mount, subPath string) (mount.Mount, error)
32+
return mount.Mount{}, nil
33+
}
34+
if mr, ok := s.m[h]; ok {
35+
- sm, err := sub(mr.mount, subPath)
36+
+ if sm, ok := mr.subRefs[subPath]; ok {
37+
+ return sm.mount, nil
38+
+ }
39+
+ sm, unmount, err := sub(mr.mount, subPath)
40+
if err != nil {
41+
return mount.Mount{}, nil
42+
}
43+
+ mr.subRefs[subPath] = mountRef{
44+
+ mount: sm,
45+
+ unmount: unmount,
46+
+ }
47+
return sm, nil
48+
}
49+
50+
@@ -191,12 +202,17 @@ func (s *submounts) subMount(m mount.Mount, subPath string) (mount.Mount, error)
51+
Options: opts,
52+
},
53+
unmount: lm.Unmount,
54+
+ subRefs: map[string]mountRef{},
55+
}
56+
57+
- sm, err := sub(s.m[h].mount, subPath)
58+
+ sm, unmount, err := sub(s.m[h].mount, subPath)
59+
if err != nil {
60+
return mount.Mount{}, err
61+
}
62+
+ s.m[h].subRefs[subPath] = mountRef{
63+
+ mount: sm,
64+
+ unmount: unmount,
65+
+ }
66+
return sm, nil
67+
}
68+
69+
@@ -206,6 +222,9 @@ func (s *submounts) cleanup() {
70+
for _, m := range s.m {
71+
func(m mountRef) {
72+
go func() {
73+
+ for _, sm := range m.subRefs {
74+
+ sm.unmount()
75+
+ }
76+
m.unmount()
77+
wg.Done()
78+
}()
79+
@@ -214,15 +233,6 @@ func (s *submounts) cleanup() {
80+
wg.Wait()
81+
}
82+
83+
-func sub(m mount.Mount, subPath string) (mount.Mount, error) {
84+
- src, err := fs.RootPath(m.Source, subPath)
85+
- if err != nil {
86+
- return mount.Mount{}, err
87+
- }
88+
- m.Source = src
89+
- return m, nil
90+
-}
91+
-
92+
func specMapping(s []idtools.IDMap) []specs.LinuxIDMapping {
93+
var ids []specs.LinuxIDMapping
94+
for _, item := range s {
95+
@@ -234,3 +244,45 @@ func specMapping(s []idtools.IDMap) []specs.LinuxIDMapping {
96+
}
97+
return ids
98+
}
99+
+
100+
+func sub(m mount.Mount, subPath string) (mount.Mount, func() error, error) {
101+
+ var retries = 10
102+
+ root := m.Source
103+
+ for {
104+
+ src, err := fs.RootPath(root, subPath)
105+
+ if err != nil {
106+
+ return mount.Mount{}, nil, err
107+
+ }
108+
+ // similar to runc.WithProcfd
109+
+ fh, err := os.OpenFile(src, unix.O_PATH|unix.O_CLOEXEC, 0)
110+
+ if err != nil {
111+
+ return mount.Mount{}, nil, err
112+
+ }
113+
+
114+
+ fdPath := "/proc/self/fd/" + strconv.Itoa(int(fh.Fd()))
115+
+ if resolved, err := os.Readlink(fdPath); err != nil {
116+
+ fh.Close()
117+
+ return mount.Mount{}, nil, err
118+
+ } else if resolved != src {
119+
+ retries--
120+
+ if retries <= 0 {
121+
+ fh.Close()
122+
+ return mount.Mount{}, nil, errors.Errorf("unable to safely resolve subpath %s", subPath)
123+
+ }
124+
+ fh.Close()
125+
+ continue
126+
+ }
127+
+
128+
+ m.Source = fdPath
129+
+ lm := snapshot.LocalMounterWithMounts([]mount.Mount{m}, snapshot.ForceRemount())
130+
+ mp, err := lm.Mount()
131+
+ if err != nil {
132+
+ fh.Close()
133+
+ return mount.Mount{}, nil, err
134+
+ }
135+
+ m.Source = mp
136+
+ fh.Close() // release the fd, we don't need it anymore
137+
+
138+
+ return m, lm.Unmount, nil
139+
+ }
140+
+}
141+
diff --git a/vendor/github.com/moby/buildkit/executor/oci/spec_windows.go b/vendor/github.com/moby/buildkit/executor/oci/spec_windows.go
142+
index 18f0019..d619a64 100644
143+
--- a/vendor/github.com/moby/buildkit/executor/oci/spec_windows.go
144+
+++ b/vendor/github.com/moby/buildkit/executor/oci/spec_windows.go
145+
@@ -4,7 +4,9 @@
146+
package oci
147+
148+
import (
149+
+ "github.com/containerd/containerd/mount"
150+
"github.com/containerd/containerd/oci"
151+
+ "github.com/containerd/continuity/fs"
152+
"github.com/docker/docker/pkg/idtools"
153+
"github.com/moby/buildkit/solver/pb"
154+
"github.com/pkg/errors"
155+
@@ -36,3 +38,12 @@ func generateIDmapOpts(idmap *idtools.IdentityMapping) ([]oci.SpecOpts, error) {
156+
}
157+
return nil, errors.New("no support for IdentityMapping on Windows")
158+
}
159+
+
160+
+func sub(m mount.Mount, subPath string) (mount.Mount, func() error, error) {
161+
+ src, err := fs.RootPath(m.Source, subPath)
162+
+ if err != nil {
163+
+ return mount.Mount{}, nil, err
164+
+ }
165+
+ m.Source = src
166+
+ return m, func() error { return nil }, nil
167+
+}
168+
diff --git a/vendor/github.com/moby/buildkit/snapshot/localmounter.go b/vendor/github.com/moby/buildkit/snapshot/localmounter.go
169+
index 9ddb7c1..304eebc 100644
170+
--- a/vendor/github.com/moby/buildkit/snapshot/localmounter.go
171+
+++ b/vendor/github.com/moby/buildkit/snapshot/localmounter.go
172+
@@ -11,22 +11,39 @@ type Mounter interface {
173+
Unmount() error
174+
}
175+
176+
+type LocalMounterOpt func(*localMounter)
177+
+
178+
// LocalMounter is a helper for mounting mountfactory to temporary path. In
179+
// addition it can mount binds without privileges
180+
-func LocalMounter(mountable Mountable) Mounter {
181+
- return &localMounter{mountable: mountable}
182+
+func LocalMounter(mountable Mountable, opts ...LocalMounterOpt) Mounter {
183+
+ lm := &localMounter{mountable: mountable}
184+
+ for _, opt := range opts {
185+
+ opt(lm)
186+
+ }
187+
+ return lm
188+
}
189+
190+
// LocalMounterWithMounts is a helper for mounting to temporary path. In
191+
// addition it can mount binds without privileges
192+
-func LocalMounterWithMounts(mounts []mount.Mount) Mounter {
193+
- return &localMounter{mounts: mounts}
194+
+func LocalMounterWithMounts(mounts []mount.Mount, opts ...LocalMounterOpt) Mounter {
195+
+ lm := &localMounter{mounts: mounts}
196+
+ for _, opt := range opts {
197+
+ opt(lm)
198+
+ }
199+
+ return lm
200+
}
201+
202+
type localMounter struct {
203+
- mu sync.Mutex
204+
- mounts []mount.Mount
205+
- mountable Mountable
206+
- target string
207+
- release func() error
208+
+ mu sync.Mutex
209+
+ mounts []mount.Mount
210+
+ mountable Mountable
211+
+ target string
212+
+ release func() error
213+
+ forceRemount bool
214+
+}
215+
+
216+
+func ForceRemount() LocalMounterOpt {
217+
+ return func(lm *localMounter) {
218+
+ lm.forceRemount = true
219+
+ }
220+
}

‎SPECS/moby-engine/CVE-2024-23652.patch‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
diff --git a/vendor/github.com/moby/buildkit/executor/stubs.go b/vendor/github.com/moby/buildkit/executor/stubs.go
2+
index 2c13b13..db56236 100644
3+
--- a/vendor/github.com/moby/buildkit/executor/stubs.go
4+
+++ b/vendor/github.com/moby/buildkit/executor/stubs.go
5+
@@ -4,6 +4,7 @@ import (
6+
"errors"
7+
"os"
8+
"path/filepath"
9+
+ "strings"
10+
"syscall"
11+
12+
"github.com/containerd/continuity/fs"
13+
@@ -36,6 +37,11 @@ func MountStubsCleaner(dir string, mounts []Mount) func() {
14+
15+
return func() {
16+
for _, p := range paths {
17+
+ p, err := fs.RootPath(dir, strings.TrimPrefix(p, dir))
18+
+ if err != nil {
19+
+ continue
20+
+ }
21+
+
22+
st, err := os.Lstat(p)
23+
if err != nil {
24+
continue
25+
@@ -43,6 +49,11 @@ func MountStubsCleaner(dir string, mounts []Mount) func() {
26+
if st.Size() != 0 {
27+
continue
28+
}
29+
+
30+
+ parent := filepath.Dir(p)
31+
+ if realPath, err := fs.RootPath(dir, strings.TrimPrefix(parent, dir)); err != nil || realPath != parent {
32+
+ continue
33+
+ }
34+
os.Remove(p)
35+
}
36+
}

‎SPECS/moby-engine/moby-engine.spec‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
Summary: The open-source application container engine
55
Name: %{upstream_name}-engine
66
Version: 20.10.27
7-
Release: 3%{?dist}
7+
Release: 4%{?dist}
88
License: ASL 2.0
99
Group: Tools/Container
1010
URL: https://mobyproject.org
@@ -21,6 +21,12 @@ Source3: docker.service
2121
Source4: docker.socket
2222
Patch0: CVE-2023-25153.patch
2323
Patch1: CVE-2022-21698.patch
24+
# Backport of vendored "buildkit" v0.12.5 https://github.com/moby/buildkit/pull/4604 to 0.8.4-0.20221020190723-eeb7b65ab7d6 in this package.
25+
# Remove once we upgrade this package at least to version 25.0+.
26+
Patch2: CVE-2024-23651.patch
27+
# Backport of vendored "buildkit" v0.12.5 https://github.com/moby/buildkit/pull/4603 to 0.8.4-0.20221020190723-eeb7b65ab7d6 in this package.
28+
# Remove once we upgrade this package at least to version 25.0+.
29+
Patch3: CVE-2024-23652.patch
2430

2531
%{?systemd_requires}
2632

@@ -128,9 +134,12 @@ fi
128134
%{_unitdir}/*
129135

130136
%changelog
131-
* Thu Feb 08 2024 Muhammad Falak <mwani@microsoft.com> - 20.10.27-3
137+
* Mon Feb 12 2024 Muhammad Falak <mwani@microsoft.com> - 20.10.27-4
132138
- Bump release to rebuild with go 1.21.6
133139

140+
* Mon Feb 12 2024 Pawel Winogrodzki <pawelwi@microsoft.com> - 20.10.27-3
141+
- Fixing CVEs: 2024-23651 and 2024-23652.
142+
134143
* Fri Feb 02 2024 Tobias Brick <tobiasb@microsoft.com> - 20.10.27-2
135144
- Patch CVE-2022-21698
136145

0 commit comments

Comments
 (0)