Skip to content

[Medium] Patch nbdkit for CVE-2025-47711 & CVE-2025-47712 #14043

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conversation

AkarshHCL
Copy link
Contributor

@AkarshHCL AkarshHCL commented Jun 19, 2025

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

  • The toolchain has been rebuilt successfully (or no changes were made to it)
  • The toolchain/worker package manifests are up-to-date
  • Any updated packages successfully build (or no packages were changed)
  • Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
  • Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
  • All package sources are available
  • cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
  • LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
  • All source files have up-to-date hashes in the *.signatures.json files
  • sudo make go-tidy-all and sudo make go-test-coverage pass
  • Documentation has been updated to match any changes to the build system
  • Ready to merge

Summary

Patch nbdkit for CVE-2025-47711 and CVE-2025-47712

For CVE-2025-47711

Patch Modified: No

Astrolabe patch reference:
https://gitlab.com/nbdkit/nbdkit/-/commit/c3c1950867ea8d9c2108ff066ed9e78dde3cfc3f

For CVE-2025-47712

Patch Modified: No

Astrolabe patch reference:
https://gitlab.com/nbdkit/nbdkit/-/commit/a486f88d1eea653ea88b0bf8804c4825dab25ec7

What does the PR accomplish, why was it needed?

Change Log
Does this affect the toolchain?

NO

Associated issues
  • #xxxx
Test Methodology

1>ptests are failing before applying the patch
Screenshot (125)
And after applying patches too.
image

2>Patch applies cleanly
Screenshot (129)

nicogbg and others added 30 commits February 26, 2024 16:56
Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
Co-authored-by: Paco Huelsz <frhuelsz@microsoft.com>
Co-authored-by: Andrew Phelps <anphel31@users.noreply.github.com>
Co-authored-by: alejandro-microsoft <128648451+alejandro-microsoft@users.noreply.github.com>
Co-authored-by: CBL-Mariner Servicing Account <cblmargh@microsoft.com>
Co-authored-by: SeanDougherty <sdougherty@microsoft.com>
Co-authored-by: Henry Beberman <henry.beberman@microsoft.com>
Co-authored-by: Henry Li <69694695+henryli001@users.noreply.github.com>
Co-authored-by: Henry Li <lihl@microsoft.com>
Co-authored-by: Bala <kumaran.4353@gmail.com>
Co-authored-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
Co-authored-by: suresh-thelkar <suresh.thelkar@yahoo.com>
Co-authored-by: Dan Streetman <ddstreet@microsoft.com>
Co-authored-by: Mandeep Plaha <99760213+mandeepsplaha@users.noreply.github.com>
Co-authored-by: jslobodzian <joslobo@microsoft.com>
Co-authored-by: George Mileka <gmileka@users.noreply.github.com>
Co-authored-by: CBL-Mariner-Bot <75509084+CBL-Mariner-Bot@users.noreply.github.com>
Co-authored-by: lanzeliu <lanzeliu@microsoft.com>
Co-authored-by: Karim Eldegwy <kimoantiqe@hotmail.com>
Co-authored-by: osamaesmailmsft <110202916+osamaesmailmsft@users.noreply.github.com>
Co-authored-by: Tobias Brick <39196763+tobiasb-ms@users.noreply.github.com>
Co-authored-by: abadawi-msft <108105696+abadawi591@users.noreply.github.com>
Co-authored-by: Mykhailo Bykhovtsev <108374904+mbykhovtsev-ms@users.noreply.github.com>
Co-authored-by: sindhu-karri <33163197+sindhu-karri@users.noreply.github.com>
Co-authored-by: Rohit Rawat <rohitrawat@microsoft.com>
Co-authored-by: Dan Streetman <ddstreet@ieee.org>
Co-authored-by: Nan Liu <108544011+liunan-ms@users.noreply.github.com>
Co-authored-by: Neha Agarwal <58672330+neha170@users.noreply.github.com>
Co-authored-by: Adit Jha <aditjha@microsoft.com>
Co-authored-by: Nan Liu <liunan@microsoft.com>
Co-authored-by: ypanch <yashpanchal@microsoft.com>
Co-authored-by: Trung <tvuong@microsoft.com>
Co-authored-by: Rakshaa Viswanathan <rviswanathan@microsoft.com>
Co-authored-by: Rakshaa Viswanathan <46165429+rakshaa2000@users.noreply.github.com>
Co-authored-by: Daniel McIlvaney <damcilva@microsoft.com>
Co-authored-by: Chris Gunn <chrisgun@microsoft.com>
Co-authored-by: Cameron E Baird <cameronbaird@microsoft.com>
Co-authored-by: Pawel Winogrodzki <pawelwi@microsoft.com>
Co-authored-by: Adub17030MS <110563293+Adub17030MS@users.noreply.github.com>
Co-authored-by: Sam Meluch <109628994+sameluch@users.noreply.github.com>
Co-authored-by: Sam Meluch <samemluch@microsoft.com>
Co-authored-by: himaja-kesari <123194058+himaja-kesari@users.noreply.github.com>
Co-authored-by: Aurélien Bombo <abombo@microsoft.com>
Co-authored-by: Lanze Liu <86434077+liulanze@users.noreply.github.com>
Co-authored-by: ms-mahuber <60939654+ms-mahuber@users.noreply.github.com>
Co-authored-by: Kanika Nema <kanikanema@microsoft.com>
…t#8404)

A recent rebranding change microsoft#8238 changed the repo name used by the containerized-rpmbuild container for mariner to azl-3.0-daily-build, but didn't change the default tdnf argument, which continued to use mariner-3.0-daily-build. This results in tdnf not working in the container.

This fix updates the tdnf argument, basing it on the string in the repo file, so we don't have to copy/paste it later.
…ET option to suppress it (microsoft#8408)

The containerized-rpmbuild scripts suppress most output from our tools/make commands, which means you have no idea what it's doing, whether it's hung, or sometimes even what caused an error.

This change switches the default to print all this output to stdout, which a new option, QUIET to suppress it.
Co-authored-by: Sam Meluch <109628994+sameluch@users.noreply.github.com>
Co-authored-by: Sam Meluch <sam.meluch@microsoft.com>
…dev (microsoft#8544)

Co-authored-by: Rachel Menge <rachelmenge@microsoft.com>
Co-authored-by: lanzeliu <lanzeliu@microsoft.com>
jslobodzian and others added 19 commits March 27, 2025 13:27
…gs (microsoft#13674)

Updated the config options in config_aarch64 as per nvidia's recently published patch guide. The config options are related to GB200 and GB200F helps h/w team to run the diagnostics.

Made modification to config_aarch64 based on nvidia's recommendation.
nvidia patch guide: https://docs.nvidia.com/grace-patch-config-guide.pdf

Co-authored-by: Rachel Menge <rachelmenge@microsoft.com>
…ft#13783)

Co-authored-by: Rachel Menge <rachelmenge@microsoft.com>
@AkarshHCL AkarshHCL requested a review from a team as a code owner June 19, 2025 13:53
@AkarshHCL AkarshHCL marked this pull request as draft June 19, 2025 13:58
@Kanishk-Bansal
Copy link
Contributor

rebase to 3.0-dev

@AkarshHCL AkarshHCL changed the base branch from 3.0 to 3.0-dev June 23, 2025 03:35
@microsoft-github-policy-service microsoft-github-policy-service bot added Tools 3.0-dev PRs Destined for AzureLinux 3.0 labels Jun 23, 2025
@AkarshHCL AkarshHCL closed this Jun 23, 2025
@AkarshHCL AkarshHCL deleted the topic_nbdkit/CVE-2025-47712+CVE-2025-47711 branch June 23, 2025 05:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3.0-dev PRs Destined for AzureLinux 3.0 3.0 PRs Destined for 3.0 Packaging security Tools
Projects
None yet
Development

Successfully merging this pull request may close these issues.