[AutoPR- Security] Patch netavark for CVE-2026-25541 [MEDIUM]#15824
Conversation
microsoft-github-policy-service
Bot
added
Packaging
3.0-dev
archana25-ms
force-pushed
the
azure-autosec/netavark/3.0/1047686
branch
from
16ff566 to
a2f6162
Compare
|
Buddy build is successful. |
|
|
||
| let offset = offset_from(self.ptr.as_ptr(), ptr); | ||
|
|
||
| + let new_cap_plus_offset = new_cap.checked_add(offset).expect("overflow"); |
There was a problem hiding this comment.
This line of change addresses the overflow, but it slightly diverges from upstream semantics.
Upstream handles this via:
match new_cap.checked_add(offset) {
Some(v) => v,
None if !allocate => return false,
None => panic!("overflow"),
}
This preserves the fallible behavior of the non-allocating reserve path.
The use of .expect("overflow") unconditionally panics, altering the behaviour for Overflow + !allocate.
For consistency and easier maintenance, it would be preferable to follow the upstream implementation.
|
Buddy Build link: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1052126&view=results Buddy build is successful with updated patch. |
|
Updated buddy build - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1055085&view=results |
Buddy build is successful. |
bhagyapathak
left a comment
bhagyapathak
left a comment
There was a problem hiding this comment.
Patch Analysis (AI Backpor with changes to match the upstream patch)
- Buddy Build
- patch applied during the build (check
rpm.log) - patch include an upstream reference
- PR has security tag
- ptest regression
Kanishk-Bansal
added
the
ready-for-stable-review
kgodara912
left a comment
kgodara912
left a comment
There was a problem hiding this comment.
Patch looks fine and buddy build is successful. Please check few minor changes.
| mkdir -p .cargo | ||
|
|
||
| cat >.cargo/config << EOF | ||
| cat > .cargo/config.toml << 'EOF' |
There was a problem hiding this comment.
Is this change required to EOF?
|
|
||
| %prep | ||
| %autosetup -Sgit -n %{name}-%{built_tag_strip} | ||
| %autosetup -N -n %{name}-%{built_tag_strip} |
There was a problem hiding this comment.
Could you please check if autosetup -a1 can work here? If not, we can at least make autopatch so that future patches we won't miss.
|
Buddy Build successful |
|
Buddy build after recent changes. |
|
/azurepipelines run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
archana25-ms
force-pushed
the
azure-autosec/netavark/3.0/1047686
branch
from
8dd55de to
54fa1f8
Compare
|
/azurepipelines run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
archana25-ms
force-pushed
the
azure-autosec/netavark/3.0/1047686
branch
from
e9ee5d4 to
36f3d93
Compare
kgodara912
left a comment
kgodara912
left a comment
There was a problem hiding this comment.
Patch matches with other merged PR patches. Buddy build is successful. LGTM.
5 participants
Auto Patch netavark for CVE-2026-25541.
Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1047686&view=results
Merge Checklist
All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)
*-staticsubpackages, etc.) have had theirReleasetag incremented../cgmanifest.json,./toolkit/scripts/toolchain/cgmanifest.json,.github/workflows/cgmanifest.json)./LICENSES-AND-NOTICES/SPECS/data/licenses.json,./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md,./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)*.signatures.jsonfilessudo make go-tidy-allandsudo make go-test-coveragepassSummary
What does the PR accomplish, why was it needed?
Change Log
Does this affect the toolchain?
YES/NO
Associated issues
Links to CVEs
Test Methodology