Repository navigation
CVE fixes suse-v29.4.0 - #12
Merged
rcmadhankumar merged 3 commits intoOct 7, 2026
Merged
Conversation
val4oss
force-pushed
the
suse-v29.4.0-cve-2026-41568
branch
from
July 15, 2026 10:02
51721d5 to
f815c05
Compare
val4oss
force-pushed
the
suse-v29.4.0-cve-2026-41568
branch
from
August 21, 2026 13:26
f815c05 to
54630d3
Compare
val4oss
changed the title
danishprakash
left a comment
danishprakash
left a comment
Member
There was a problem hiding this comment.
The commit messages are missing bugzilla refs, SUSE-Bugs: bsc#<>, can you add those?
…creation Use os.Root to scope all filesystem operations in createIfNotExists to the container root directory. This prevents a TOCTOU attack where a container process swaps a path component with a symlink between GetResourcePath resolution and directory/file creation, which could allow writing to arbitrary host paths outside the container. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com> (cherry picked from commit 64a22d8) SUSE-Bugs: bsc#1268280<https://bugzilla.suse.com/show_bug.cgi?id=1268280>
* hashicorp/memberlist@371698b limit remote state header values (moby#357) The header of a push-pull state message contains a count of nodes and user state length. As an optimization, both of these fields are used to pre-allocate memory to receive the remote state before copying it off the wire. But if the header mismatches the actual state, a very small pull-push state message (or at least one below the message size limit) can be used to consume excess memory on the receiver. Limit the memory allocated such that the maximum amount allocated cannot exceed the maximum actual size of the push-pull state, either in number of nodes or size of the user state. Ref: https://hashicorp.atlassian.net/browse/SECVULN-42161 Ref: https://hashicorp.atlassian.net/browse/NMD-1523 hashicorp/memberlist@bc32294 limit user message length (moby#361) readUserMsg sizes make([]byte, header.UserMsgLen) from the wire header with no bound, so a small userMsg frame declaring a large length forces a large allocation on the receiver. This is the userMsg path of the same issue moby#357 fixed for push-pull state. Fixes: moby#360 hashicorp/memberlist@7de15ac limit decompressed message size (moby#363) decompressBuffer drains the LZW reader with io.Copy into an unbounded buffer, so a small compressMsg expands without limit and can exhaust memory. Cap the output at maxDecompressedBytes with io.CopyN and error past it. SUSE-Bugs: bsc#1271209<https://bugzilla.suse.com/show_bug.cgi?id=1271209>
val4oss
force-pushed
the
suse-v29.4.0-cve-2026-41568
branch
from
August 25, 2026 14:34
54630d3 to
a051727
Compare
Author
Thanks for the information, reference to bug added in the commits. Is it good ? |
Detect strconv.ErrRange and validate uid/gid bounds to avoid falling back to username/group lookups in /etc/passwd. Signed-off-by: LEI WANG <ssst0n3@gmail.com> (cherry picked from commit 85706b6d4416d93b47033ba345d7b885a75657b4) SUSE-Bugs: bsc#1268359<https://bugzilla.suse.com/show_bug.cgi?id=1268359>
Author
|
@rcmadhankumar This has been opened for a while now, maybe it can be merged now ? Or are there some missing stuff to add ? |
|
LGTM |
rcmadhankumar
pushed a commit
to rcmadhankumar/suse-docker
that referenced
this pull request
Oct 28, 2026
limit user message length (moby#361) readUserMsg sizes make([]byte, header.UserMsgLen) from the wire header with no bound, so a small userMsg frame declaring a large length forces a large allocation on the receiver. This is the userMsg path of the same issue moby#357 fixed for push-pull state. Fixes: moby#360 limit decompressed message size (moby#363) decompressBuffer drains the LZW reader with io.Copy into an unbounded buffer, so a small compressMsg expands without limit and can exhaust memory. Cap the output at maxDecompressedBytes with io.CopyN and error past it. --- Completes the bsc#1271209/CVE-2026-14362 fix on this branch: the previous commit (9c6ed35) only ported the push-pull state header fix (moby#357). These are the other two upstream commits from the same HashiCorp security advisory (HCSEC-2026-18), fixing the same class of unvalidated-length-triggers-large-allocation bug on the other two affected wire paths. Noticed these were missing by cross-checking against SUSE/docker PR SUSE#12 (a different, unrelated docker version branch, suse-v29.4.0), whose CVE-2026-14362 fix commit (a051727) bundles all three upstream commits together. Cherry-picked both cleanly onto this vendored memberlist (v0.4.0): the upstream readUserMsg/maxUserMsgBytes and decompressBuffer/ maxDecompressedBytes changes apply directly, since net.go/util.go are structurally unchanged between v0.4.0 and v0.6.0 for these two functions specifically. Verified with go build/go vet (via hack/with-go-mod.sh) against the modified package and libnetwork/, plus two more temporary local tests: a crafted userMsg header with an oversized UserMsgLen is rejected before allocation, and a decompression bomb (41MB of zeros compressing to ~31KB) is rejected by decompressBuffer while a payload within the limit still decompresses correctly. Fixes CVE-2026-14362 Fixes bsc#1271209 Cherry-picked from hashicorp/memberlist@bc32294 ("limit user message length (moby#361)") Cherry-picked from hashicorp/memberlist@7de15ac ("limit decompressed message size (moby#363)") Advisory: https://discuss.hashicorp.com/t/hcsec-2026-18-memberlist-vulnerable-to-denial-of-service-via-gossip-message/77556 Signed-off-by: rcmadhankumar <madhankumar.chellamuthu@suse.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CVE-2026-41568: daemon/copy: Fix symlink escape in mount destination creation
CVE-2026-14362: HashiCorp memberlist fix DOS
CVE-2026-46680: oci: return explicit error for out-of-range USER values