Skip to content

Commit 90d2ba6

Browse files
CBL-Mariner-Botarchana25-msjslobodzian
authored
[AUTO-CHERRYPICK] [CRITICAL] Patch kata-containers for CVE-2026-24834 , [MEDIUM] CVE-2026-25727, CVE-2025-65637, CVE-2026-25541 and CVE-2025-11065 - branch 3.0-dev (#15991)
Co-authored-by: Archana Shettigar <v-shettigara@microsoft.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
1 parent 15c43ca commit 90d2ba6

File tree

6 files changed

+1406
-7
lines changed

6 files changed

+1406
-7
lines changed

‎SPECS/kata-containers/CVE-2025-11065.patch‎

Lines changed: 283 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,283 @@
1+
From 742921c9ba2854d27baa64272487fc5075d2c39c Mon Sep 17 00:00:00 2001
2+
From: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
3+
Date: Sat, 12 Jul 2025 07:25:50 +0200
4+
Subject: [PATCH] fix: error message leaks
5+
6+
Signed-off-by: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
7+
8+
Upstream Patch reference: https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c.patch
9+
10+
---
11+
.../mitchellh/mapstructure/decode_hooks.go | 12 +-
12+
.../mitchellh/mapstructure/error.go | 156 ++++++++++++++++++
13+
.../mitchellh/mapstructure/mapstructure.go | 10 +-
14+
3 files changed, 169 insertions(+), 9 deletions(-)
15+
16+
diff --git a/src/runtime/vendor/github.com/mitchellh/mapstructure/decode_hooks.go b/src/runtime/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
17+
index 3a754ca..4dfab7d 100644
18+
--- a/src/runtime/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
19+
+++ b/src/runtime/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
20+
@@ -134,7 +134,9 @@ func StringToTimeDurationHookFunc() DecodeHookFunc {
21+
}
22+
23+
// Convert it by parsing
24+
- return time.ParseDuration(data.(string))
25+
+ d, err := time.ParseDuration(data.(string))
26+
+
27+
+ return d, wrapTimeParseDurationError(err)
28+
}
29+
}
30+
31+
@@ -155,7 +157,7 @@ func StringToIPHookFunc() DecodeHookFunc {
32+
// Convert it by parsing
33+
ip := net.ParseIP(data.(string))
34+
if ip == nil {
35+
- return net.IP{}, fmt.Errorf("failed parsing ip %v", data)
36+
+ return net.IP{}, fmt.Errorf("failed parsing ip")
37+
}
38+
39+
return ip, nil
40+
@@ -178,7 +180,7 @@ func StringToIPNetHookFunc() DecodeHookFunc {
41+
42+
// Convert it by parsing
43+
_, net, err := net.ParseCIDR(data.(string))
44+
- return net, err
45+
+ return net, wrapNetParseError(err)
46+
}
47+
}
48+
49+
@@ -197,7 +199,9 @@ func StringToTimeHookFunc(layout string) DecodeHookFunc {
50+
}
51+
52+
// Convert it by parsing
53+
- return time.Parse(layout, data.(string))
54+
+ ti, err := time.Parse(layout, data.(string))
55+
+
56+
+ return ti, wrapTimeParseError(err)
57+
}
58+
}
59+
60+
diff --git a/src/runtime/vendor/github.com/mitchellh/mapstructure/error.go b/src/runtime/vendor/github.com/mitchellh/mapstructure/error.go
61+
index 47a99e5..28f3114 100644
62+
--- a/src/runtime/vendor/github.com/mitchellh/mapstructure/error.go
63+
+++ b/src/runtime/vendor/github.com/mitchellh/mapstructure/error.go
64+
@@ -3,8 +3,12 @@ package mapstructure
65+
import (
66+
"errors"
67+
"fmt"
68+
+ "net"
69+
+ "net/url"
70+
"sort"
71+
+ "strconv"
72+
"strings"
73+
+ "time"
74+
)
75+
76+
// Error implements the error interface and can represents multiple
77+
@@ -48,3 +53,155 @@ func appendErrors(errors []string, err error) []string {
78+
return append(errors, e.Error())
79+
}
80+
}
81+
+
82+
+func wrapStrconvNumError(err error) error {
83+
+ if err == nil {
84+
+ return nil
85+
+ }
86+
+
87+
+ if err, ok := err.(*strconv.NumError); ok {
88+
+ return &strconvNumError{Err: err}
89+
+ }
90+
+
91+
+ return err
92+
+}
93+
+
94+
+type strconvNumError struct {
95+
+ Err *strconv.NumError
96+
+}
97+
+
98+
+func (e *strconvNumError) Error() string {
99+
+ return "strconv." + e.Err.Func + ": " + e.Err.Err.Error()
100+
+}
101+
+
102+
+func (e *strconvNumError) Unwrap() error { return e.Err }
103+
+
104+
+func wrapUrlError(err error) error {
105+
+ if err == nil {
106+
+ return nil
107+
+ }
108+
+
109+
+ if err, ok := err.(*url.Error); ok {
110+
+ return &urlError{Err: err}
111+
+ }
112+
+
113+
+ return err
114+
+}
115+
+
116+
+type urlError struct {
117+
+ Err *url.Error
118+
+}
119+
+
120+
+func (e *urlError) Error() string {
121+
+ return fmt.Sprintf("%s", e.Err.Err)
122+
+}
123+
+
124+
+func (e *urlError) Unwrap() error { return e.Err }
125+
+
126+
+func wrapNetParseError(err error) error {
127+
+ if err == nil {
128+
+ return nil
129+
+ }
130+
+
131+
+ if err, ok := err.(*net.ParseError); ok {
132+
+ return &netParseError{Err: err}
133+
+ }
134+
+
135+
+ return err
136+
+}
137+
+
138+
+type netParseError struct {
139+
+ Err *net.ParseError
140+
+}
141+
+
142+
+func (e *netParseError) Error() string {
143+
+ return "invalid " + e.Err.Type
144+
+}
145+
+
146+
+func (e *netParseError) Unwrap() error { return e.Err }
147+
+
148+
+func wrapTimeParseError(err error) error {
149+
+ if err == nil {
150+
+ return nil
151+
+ }
152+
+
153+
+ if err, ok := err.(*time.ParseError); ok {
154+
+ return &timeParseError{Err: err}
155+
+ }
156+
+
157+
+ return err
158+
+}
159+
+
160+
+type timeParseError struct {
161+
+ Err *time.ParseError
162+
+}
163+
+
164+
+func (e *timeParseError) Error() string {
165+
+ if e.Err.Message == "" {
166+
+ return fmt.Sprintf("parsing time as %q: cannot parse as %q", e.Err.Layout, e.Err.LayoutElem)
167+
+ }
168+
+
169+
+ return "parsing time " + e.Err.Message
170+
+}
171+
+
172+
+func (e *timeParseError) Unwrap() error { return e.Err }
173+
+
174+
+func wrapNetIPParseAddrError(err error) error {
175+
+ if err == nil {
176+
+ return nil
177+
+ }
178+
+
179+
+ if errMsg := err.Error(); strings.HasPrefix(errMsg, "ParseAddr") {
180+
+ errPieces := strings.Split(errMsg, ": ")
181+
+
182+
+ return fmt.Errorf("ParseAddr: %s", errPieces[len(errPieces)-1])
183+
+ }
184+
+
185+
+ return err
186+
+}
187+
+
188+
+func wrapNetIPParseAddrPortError(err error) error {
189+
+ if err == nil {
190+
+ return nil
191+
+ }
192+
+
193+
+ errMsg := err.Error()
194+
+ if strings.HasPrefix(errMsg, "invalid port ") {
195+
+ return errors.New("invalid port")
196+
+ } else if strings.HasPrefix(errMsg, "invalid ip:port ") {
197+
+ return errors.New("invalid ip:port")
198+
+ }
199+
+
200+
+ return err
201+
+}
202+
+
203+
+func wrapNetIPParsePrefixError(err error) error {
204+
+ if err == nil {
205+
+ return nil
206+
+ }
207+
+
208+
+ if errMsg := err.Error(); strings.HasPrefix(errMsg, "netip.ParsePrefix") {
209+
+ errPieces := strings.Split(errMsg, ": ")
210+
+
211+
+ return fmt.Errorf("netip.ParsePrefix: %s", errPieces[len(errPieces)-1])
212+
+ }
213+
+
214+
+ return err
215+
+}
216+
+
217+
+func wrapTimeParseDurationError(err error) error {
218+
+ if err == nil {
219+
+ return nil
220+
+ }
221+
+
222+
+ errMsg := err.Error()
223+
+ if strings.HasPrefix(errMsg, "time: unknown unit ") {
224+
+ return errors.New("time: unknown unit")
225+
+ } else if strings.HasPrefix(errMsg, "time: ") {
226+
+ idx := strings.LastIndex(errMsg, " ")
227+
+
228+
+ return errors.New(errMsg[:idx])
229+
+ }
230+
+
231+
+ return err
232+
+}
233+
diff --git a/src/runtime/vendor/github.com/mitchellh/mapstructure/mapstructure.go b/src/runtime/vendor/github.com/mitchellh/mapstructure/mapstructure.go
234+
index 1efb22a..f771761 100644
235+
--- a/src/runtime/vendor/github.com/mitchellh/mapstructure/mapstructure.go
236+
+++ b/src/runtime/vendor/github.com/mitchellh/mapstructure/mapstructure.go
237+
@@ -642,7 +642,7 @@ func (d *Decoder) decodeInt(name string, data interface{}, val reflect.Value) er
238+
if err == nil {
239+
val.SetInt(i)
240+
} else {
241+
- return fmt.Errorf("cannot parse '%s' as int: %s", name, err)
242+
+ return fmt.Errorf("cannot parse '%s' as int: %s", name, wrapStrconvNumError(err))
243+
}
244+
case dataType.PkgPath() == "encoding/json" && dataType.Name() == "Number":
245+
jn := data.(json.Number)
246+
@@ -699,14 +699,14 @@ func (d *Decoder) decodeUint(name string, data interface{}, val reflect.Value) e
247+
if err == nil {
248+
val.SetUint(i)
249+
} else {
250+
- return fmt.Errorf("cannot parse '%s' as uint: %s", name, err)
251+
+ return fmt.Errorf("cannot parse '%s' as uint: %s", name, wrapStrconvNumError(err))
252+
}
253+
case dataType.PkgPath() == "encoding/json" && dataType.Name() == "Number":
254+
jn := data.(json.Number)
255+
i, err := strconv.ParseUint(string(jn), 0, 64)
256+
if err != nil {
257+
return fmt.Errorf(
258+
- "error decoding json.Number into %s: %s", name, err)
259+
+ "error decoding json.Number into %s: %s", name, wrapStrconvNumError(err))
260+
}
261+
val.SetUint(i)
262+
default:
263+
@@ -738,7 +738,7 @@ func (d *Decoder) decodeBool(name string, data interface{}, val reflect.Value) e
264+
} else if dataVal.String() == "" {
265+
val.SetBool(false)
266+
} else {
267+
- return fmt.Errorf("cannot parse '%s' as bool: %s", name, err)
268+
+ return fmt.Errorf("cannot parse '%s' as bool: %s", name, wrapStrconvNumError(err))
269+
}
270+
default:
271+
return fmt.Errorf(
272+
@@ -777,7 +777,7 @@ func (d *Decoder) decodeFloat(name string, data interface{}, val reflect.Value)
273+
if err == nil {
274+
val.SetFloat(f)
275+
} else {
276+
- return fmt.Errorf("cannot parse '%s' as float: %s", name, err)
277+
+ return fmt.Errorf("cannot parse '%s' as float: %s", name, wrapStrconvNumError(err))
278+
}
279+
case dataType.PkgPath() == "encoding/json" && dataType.Name() == "Number":
280+
jn := data.(json.Number)
281+
--
282+
2.45.4
283+

0 commit comments

Comments
 (0)