[Medium] Patch mysql for CVE-2025-0838 by v-aaditya · Pull Request #15867 · microsoft/azurelinux

v-aaditya · 2026-02-17T06:55:10Z

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

Summary

Patch mysql for CVE-2025-0838

Upstream patch has been backported manually.
Defined ABSL_SWISSTABLE_ASSERT macro, referred upstream source.
SlotOffset() has been used in place of slot_offset_ from upstream patch, as its already being used in the current source.
Upstream Patch reference: https://github.com/abseil/abseil-cpp/commit/5a0e2cb5e3958dd90bb8569a2766622cb74d90c1.patch

Change Log

modified: SPECS/mysql/mysql.spec
added: SPECS/mysql/CVE-2025-0838.patch

Does this affect the toolchain?

NO

Links to CVEs

https://nvd.nist.gov/vuln/detail/CVE-2025-0838

Test Methodology

Local build could not be completed due to resource limitation.

v-aaditya · 2026-02-17T07:53:53Z

Buddy Build has been triggered - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1050450&view=results

Kanishk-Bansal · 2026-02-17T08:11:34Z

as the ptest is known failure and we have skipped it in 2.0 as well. Can you skip it here as well? Even fedora has skipped the tests.

v-aaditya · 2026-02-17T08:35:26Z

as the ptest is known failure and we have skipped it in 2.0 as well. Can you skip it here as well? Even fedora has skipped the tests.
Skipped the ptests by updating the spec file.

Kanishk-Bansal · 2026-02-17T08:41:13Z

After skipping the known failure cases - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1050530&view=results

v-aaditya · 2026-02-17T11:22:06Z

After skipping the known failure cases - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1050530&view=results

The Buddy Build has passed on arm64 but failed on amd64 due to test case failure. The test cases which are getting failed are similar to the ones which were failed in the 1st Buddy Build, although SPEC file is updated as per 2.0 branch.

I am looking into it.

v-aaditya · 2026-02-18T05:32:07Z

After skipping the known failure cases - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1050530&view=results

The Buddy Build has passed on arm64 but failed on amd64 due to test case failure. The test cases which are getting failed are similar to the ones which were failed in the 1st Buddy Build, although SPEC file is updated as per 2.0 branch.

I am looking into it.

Hi @Kanishk-Bansal

Till now my observations are as follows -

The test cases which are getting failed are actually failing in earlier builds as well, referred past build test logs.
"merge_large_tests" test-suite which is skipped in latest Buddy build, is actually getting passed in 1st buddy build of this PR.

Now I am investigating, how these test cases are getting passed on 2.0 branch, but getting failed here on 3.0 branch.

Kanishk-Bansal · 2026-02-18T11:28:47Z

Buddy Build

v-aaditya · 2026-02-19T04:27:34Z

Buddy Build

Buddy Build has failed again and similar cases failing here as well when compared to 2nd Buddy build. Although when I tried to build locally using containerized rpm build for mysql with latest spec file, only 3 cases were getting failed due to timeout and other reasons.

I am looking into it.

v-aaditya · 2026-02-27T10:22:22Z

Buddy Build has been triggered again - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1058494&view=results

v-aaditya · 2026-02-27T12:13:11Z

Buddy Build has been triggered again - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1058494&view=results

The latest buddy build has failed due to some dead code related to GTEST is present in the file, from where the ptests have been removed. Once the dead code is removed, the Buddy build will pass. Patch file need to be updated.

Kindly note, that no such issues came while executing containerized RPM build locally.

v-aaditya · 2026-03-03T06:18:03Z

Again, triggered the Buddy Build - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1061155&view=results

v-aaditya · 2026-03-03T07:37:01Z

Again, triggered the Buddy Build - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1061155&view=results

The latest Buddy Build has passed.
CC: @Kanishk-Bansal

v-aaditya · 2026-03-05T08:19:08Z

Again, triggered the Buddy Build with updated patch file - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1063464&view=results

v-aaditya · 2026-03-05T08:52:45Z

Again, triggered the Buddy Build with updated patch file - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1063464&view=results

The Buddy Build has failed due to reasons unrelated to this PR. All the Buddy builds which have been triggered today, have same issue.

It has to be re-triggered once the Buddy Build issue is resolved.

Kanishk-Bansal · 2026-03-09T06:06:54Z

Buddy Build

mfrw

Patches apply cleanly
Patch looks good w.r.t upstream
Test Build passes

Signed-Off by: @mfrw

mfrw · 2026-03-12T07:10:12Z

+   size_t capacity() const { return common().capacity(); }
+-  size_t max_size() const { return (std::numeric_limits<size_t>::max)(); }
+  size_t max_size() const {
+    return CapacityToGrowth(MaxValidCapacity<sizeof(slot_type)>());


Patch looks good w.r.t upstream

kgodara912

Please don't skip test cases which are only failing for one architecture instead, the tests can be conditionally included or excluded. Only large tests was the one which was having issue. Include other test for arm testing. You may apply changes conditionally based on arch, so when arch is not x86, then don't apply the patch so all other architectures can be tested.

v-aaditya · 2026-03-16T04:40:25Z

Please don't skip test cases which are only failing for one architecture instead, the tests can be conditionally included or excluded. Only large tests was the one which was having issue. Include other test for arm testing. You may apply changes conditionally based on arch, so when arch is not x86, then don't apply the patch so all other architectures can be tested.

Sure, I will update the spec file accordingly and confirm.

v-aaditya · 2026-03-16T07:29:27Z

Updated the spec file.
@Kanishk-Bansal Could you please re-trigger the Buddy Build.

v-aaditya · 2026-03-16T08:56:18Z

Please don't skip test cases which are only failing for one architecture instead, the tests can be conditionally included or excluded. Only large tests was the one which was having issue. Include other test for arm testing. You may apply changes conditionally based on arch, so when arch is not x86, then don't apply the patch so all other architectures can be tested.

Hi @kgodara912
I have updated the spec file and now the patch only applies on x86_64 arch.
The latest Buddy Build has been triggered and has passed !
I have also referred the same in generated logs and verified that the patch only applies on amd64 and it does not apply on arm64.

kgodara912

Upstream patch is backported with adaptation to the existing version. Buddy build is successful. The test failures were specific to x86 and are addressed in this along with flaky merge_large_tests test . LGTM.

microsoft-github-policy-service Bot added Packaging 3.0-dev PRs Destined for AzureLinux 3.0 labels Feb 17, 2026

Kanishk-Bansal added the security label Feb 17, 2026

v-aaditya marked this pull request as ready for review February 17, 2026 08:40

v-aaditya requested a review from a team as a code owner February 17, 2026 08:40

v-aaditya mentioned this pull request Feb 17, 2026

[Medium] Patch mysql for CVE-2025-0838 and updated patch for CVE-2024-2410 #15874

Merged

12 tasks

v-aaditya added 4 commits February 27, 2026 10:04

Patch mysql for CVE-2025-0838

fd1c7e7

Exclude merge_large_tests in package test

747e551

Updated spec file to resolve test failure

6f30add

Added patch to skip failed ptests

a8204ca

v-aaditya force-pushed the topic_mysql-3.0 branch from b8b9a65 to a8204ca Compare February 27, 2026 10:06

Updated patch to resolve test failure

154e3a7

Updated patch file to use GTest macro to disable ptests

37474ef

BinduSri-6522866 mentioned this pull request Mar 9, 2026

Fix ptest for mysql #16074

Closed

12 tasks

mfrw approved these changes Mar 12, 2026

View reviewed changes

Kanishk-Bansal added the ready-for-stable-review PR has passed initial review and is now ready for a second-level stable maintainer review label Mar 12, 2026

kgodara912 requested changes Mar 16, 2026

View reviewed changes

Updated spec file to add arch specific condition

61f451f

kgodara912 approved these changes Mar 19, 2026

View reviewed changes

kgodara912 merged commit d03ae43 into microsoft:3.0-dev Mar 19, 2026
17 checks passed

BinduSri-6522866 pushed a commit to BinduSri-6522866/azurelinux that referenced this pull request Mar 31, 2026

[Medium] Patch mysql for CVE-2025-0838 (microsoft#15867)

9663fc5

AkarshHCL pushed a commit to AkarshHCL/azurelinux that referenced this pull request Apr 27, 2026

[Medium] Patch mysql for CVE-2025-0838 (microsoft#15867)

57b901b

Conversation

v-aaditya commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Checklist

Summary

Change Log

Does this affect the toolchain?

Links to CVEs

Test Methodology

Uh oh!

v-aaditya commented Feb 17, 2026

Uh oh!

Kanishk-Bansal commented Feb 17, 2026

Uh oh!

v-aaditya commented Feb 17, 2026

Uh oh!

Kanishk-Bansal commented Feb 17, 2026

Uh oh!

v-aaditya commented Feb 17, 2026

Uh oh!

v-aaditya commented Feb 18, 2026

Uh oh!

Kanishk-Bansal commented Feb 18, 2026

Uh oh!

v-aaditya commented Feb 19, 2026

Uh oh!

v-aaditya commented Feb 27, 2026

Uh oh!

v-aaditya commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

v-aaditya commented Mar 3, 2026

Uh oh!

v-aaditya commented Mar 3, 2026

Uh oh!

v-aaditya commented Mar 5, 2026

Uh oh!

v-aaditya commented Mar 5, 2026

Uh oh!

Kanishk-Bansal commented Mar 9, 2026

Uh oh!

mfrw left a comment

Choose a reason for hiding this comment

Uh oh!

mfrw Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

kgodara912 left a comment

Choose a reason for hiding this comment

Uh oh!

v-aaditya commented Mar 16, 2026

Uh oh!

v-aaditya commented Mar 16, 2026

Uh oh!

v-aaditya commented Mar 16, 2026

Uh oh!

kgodara912 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

v-aaditya commented Feb 17, 2026 •

edited

Loading

v-aaditya commented Feb 27, 2026 •

edited

Loading