Skip to content

[Low] Patch kubernetes for CVE-2024-45310 #13294

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
v-smalavathu wants to merge 2 commits into from
Closed

[Low] Patch kubernetes for CVE-2024-45310 #13294

v-smalavathu wants to merge 2 commits into from

Conversation

@v-smalavathu
Copy link
Contributor

@v-smalavathu v-smalavathu commented Apr 8, 2025

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

  • The toolchain has been rebuilt successfully (or no changes were made to it)
  • The toolchain/worker package manifests are up-to-date
  • Any updated packages successfully build (or no packages were changed)
  • Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
  • Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
  • All package sources are available
  • cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
  • LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
  • All source files have up-to-date hashes in the *.signatures.json files
  • sudo make go-tidy-all and sudo make go-test-coverage pass
  • Documentation has been updated to match any changes to the build system
  • Ready to merge
Summary

kubernetes: Patch for CVE-2024-45310

Change Log
  • new file: SPECS/kubernetes/CVE-2024-45310.patch
  • modified: SPECS/kubernetes/kubernetes.spec
Does this affect the toolchain?

NO

Associated issues
  • #xxxx
Links to CVEs
Test Methodology
  • Pipeline build id: xxxx

@v-smalavathu
Addressing CVE-2024-45310
1a3d58b 
Signed-off-by: Sreenivasulu Malavathula <v-smalavathu@microsoft.com>
@v-smalavathu v-smalavathu requested a review from a team as a code owner April 8, 2025 01:26
@microsoft-github-policy-service microsoft-github-policy-service bot added Packaging fasttrack/3.0 PRs Destined for Azure Linux 3.0 labels Apr 8, 2025
kgodara912
kgodara912 reviewed Apr 8, 2025
View reviewed changes
SPECS/kubernetes/CVE-2024-45310.patch
+// but properly handling the case where path or root are "/".
+//
+// NOTE: The return value only make sense if the path doesn't contain "..".
+func IsLexicallyInRoot(root, path string) bool {
Copy link
Contributor

@kgodara912 kgodara912 Apr 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this function called from somewhere? It doesn't look like to be fixing anything.

Copy link
Contributor Author

@v-smalavathu v-smalavathu Apr 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agree. missing some parts of code.
Working on it.
Realized after PR generated,

Copy link
Contributor Author

@v-smalavathu v-smalavathu Apr 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated the Patch file.
-Thanks

@Kanishk-Bansal
Copy link
Contributor

Kanishk-Bansal commented Apr 8, 2025 •
edited
Loading

Three files are affected
libcontainer/container_linux.go
libcontainer/rootfs_linux.go
libcontainer/utils/utils_unix.go

where as you have added patch for a single file

@v-smalavathu
Copy link
Contributor Author

v-smalavathu commented Apr 8, 2025

Three files are affected libcontainer/container_linux.go libcontainer/rootfs_linux.go libcontainer/utils/utils_unix.go

where as you have added patch for a single file

Working on it.
The Patch files are out of sync. missing functions and parts of code.

@v-smalavathu
Copy link
Contributor Author

v-smalavathu commented Apr 9, 2025

Three files are affected libcontainer/container_linux.go libcontainer/rootfs_linux.go libcontainer/utils/utils_unix.go

where as you have added patch for a single file

Update the Patch file.
-Thanks

Kanishk-Bansal
Kanishk-Bansal requested changes Apr 10, 2025
View reviewed changes
Copy link
Contributor

@Kanishk-Bansal Kanishk-Bansal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Ankita13-code
need your inputs in this CVE

@Ankita13-code
Copy link
Contributor

Ankita13-code commented Apr 11, 2025

The runc version we are using (1.2.2) is not affected since this vulnerability exists for only <=1.1.13, <=1.2.0-rc.2 Hence, we are not vulnerable to this CVE

Hence closing this PR

@v-smalavathu
Copy link
Contributor Author

v-smalavathu commented Apr 11, 2025

Ankita,
Thanks for update.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kgodara912 kgodara912 kgodara912 left review comments

@Kanishk-Bansal Kanishk-Bansal Kanishk-Bansal requested changes

Assignees

No one assigned

Labels

fasttrack/3.0 PRs Destined for Azure Linux 3.0 Packaging

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@v-smalavathu @Kanishk-Bansal @Ankita13-code @kgodara912