[AUTO-CHERRYPICK] Fix patch logic & add patches for CVE-2022-4318, CVE-2024-9341 & CVE-2024-45338 in cri-o - branch main (#11863)

Co-authored-by: Sumedh Alok Sharma <sumsharma@microsoft.com>

Author: CBL-Mariner-Bot

SPECS/cri-o/CVE-2022-1708.patch

@@ -360,15 +360,3 @@ index 3e7577d..ea7b635 100644
  @test "ctr device add" {
  	# In an user namespace we can only bind mount devices from the host, not mknod
  	# https://github.com/opencontainers/runc/blob/master/libcontainer/rootfs_linux.go#L480-L481
-diff --git a/vendor/modules.txt b/vendor/modules.txt
-index 6f8a08b..1899c90 100644
---- a/vendor/modules.txt
-+++ b/vendor/modules.txt
-@@ -1517,6 +1517,7 @@ k8s.io/kubernetes/pkg/kubelet/cri/streaming
- k8s.io/kubernetes/pkg/kubelet/cri/streaming/portforward
- k8s.io/kubernetes/pkg/kubelet/cri/streaming/remotecommand
- k8s.io/kubernetes/pkg/kubelet/types
-+k8s.io/kubernetes/pkg/kubelet/util/ioutils
- k8s.io/kubernetes/pkg/proxy
- k8s.io/kubernetes/pkg/proxy/config
- k8s.io/kubernetes/pkg/proxy/healthcheck

SPECS/cri-o/CVE-2022-4318.patch

@@ -0,0 +1,46 @@
+From 41dca27cb53bca3c9255287f53e241b9d3bfd7de Mon Sep 17 00:00:00 2001
+From: Peter Hunt~ <pehunt@redhat.com>
+Date: Wed, 14 Dec 2022 18:15:50 -0500
+Subject: [PATCH] server: fail if HOME variable has a newline
+
+to prevent CVE-2022-4318
+
+Signed-off-by: Peter Hunt~ <pehunt@redhat.com>
+---
+ server/container_create.go | 3 +++
+ test/ctr.bats              | 8 ++++++++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/server/container_create.go b/server/container_create.go
+index fb835b0..d07e2f1 100644
+--- a/server/container_create.go
++++ b/server/container_create.go
+@@ -196,6 +196,9 @@ func setupContainerUser(ctx context.Context, specgen *generate.Generator, rootfs
+ 	for _, env := range specgen.Config.Process.Env {
+ 		if strings.HasPrefix(env, "HOME=") {
+ 			homedir = strings.TrimPrefix(env, "HOME=")
++			if idx := strings.Index(homedir, `\n`); idx > -1 {
++				return fmt.Errorf("invalid HOME environment; newline not allowed")
++			}
+ 			break
+ 		}
+ 	}
+diff --git a/test/ctr.bats b/test/ctr.bats
+index 67f941f..9c48149 100644
+--- a/test/ctr.bats
++++ b/test/ctr.bats
+@@ -938,3 +938,11 @@ function check_oci_annotation() {
+ 	pod_id=$(crictl runp "$TESTDATA"/sandbox_config.json)
+ 	! crictl create "$pod_id" "$TESTDIR/config" "$TESTDATA"/sandbox_config.json
+ }
++
++@test "ctr HOME env newline invalid" {
++	start_crio
++	jq ' .envs = [{"key": "HOME=", "value": "/root:/sbin/nologin\\ntest::0:0::/:/bin/bash"}]' \
++		"$TESTDATA"/container_config.json > "$newconfig"
++
++	! crictl run "$newconfig" "$TESTDATA"/sandbox_config.json
++}
+-- 
+2.25.1
+