Skip to content

[Low] Patch kubernetes for CVE-2024-45310#13469

Closed
v-smalavathu wants to merge 5 commits into
microsoft:mainfrom
v-smalavathu:v-smalavathu/kubernetes/CVE-2024-45310_2-kubernetes
Closed

[Low] Patch kubernetes for CVE-2024-45310#13469
v-smalavathu wants to merge 5 commits into
microsoft:mainfrom
v-smalavathu:v-smalavathu/kubernetes/CVE-2024-45310_2-kubernetes

Conversation

@v-smalavathu
Copy link
Copy Markdown
Contributor

@v-smalavathu v-smalavathu commented Apr 17, 2025 •
edited
Loading

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

  • The toolchain has been rebuilt successfully (or no changes were made to it)
  • The toolchain/worker package manifests are up-to-date
  • Any updated packages successfully build (or no packages were changed)
  • Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
  • Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
  • All package sources are available
  • cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
  • LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
  • All source files have up-to-date hashes in the *.signatures.json files
  • sudo make go-tidy-all and sudo make go-test-coverage pass
  • Documentation has been updated to match any changes to the build system
  • Ready to merge
Summary

kubernetes: Patch for CVE-2024-45310

Astrolabe Patch "opencontainers/runc#4359" is incorrect.

Change Log
  • new file: SPECS/kubernetes/CVE-2024-45310.patch
  • modified: SPECS/kubernetes/kubernetes.spec
Does this affect the toolchain?

NO

Associated issues
  • #xxxx
Links to CVEs
Test Methodology

  • local build on my VM

  • Applied Patch successfully as shown below
    image

  • Pipeline build id: xxxx

@v-smalavathu
Addressing CVE-2024-45310
4778c01 
Signed-off-by: Sreenivasulu Malavathula <v-smalavathu@microsoft.com>
@v-smalavathu v-smalavathu requested a review from a team as a code owner April 17, 2025 23:32
kgodara912
kgodara912 reviewed Apr 27, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@kgodara912 kgodara912 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Build build: 797166

Comment thread SPECS/kubernetes/CVE-2024-45310.patch Outdated
}
+
+// syscallMode returns the syscall-specific mode bits from Go's portable mode bits.
+// Copy from https://cs.opensource.google/go/go/+/refs/tags/go1.20.7:src/os/file_posix.go;l=61-75
Copy link
Copy Markdown
Contributor

@kgodara912 kgodara912 Apr 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of putting reference here, you may also put this new function reference at the top with other references.

Copy link
Copy Markdown
Contributor Author

@v-smalavathu v-smalavathu Apr 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, Done

@Kanishk-Bansal
Copy link
Copy Markdown
Contributor

Kanishk-Bansal commented Jun 4, 2025 •
edited
Loading

Investigate Build Failure

time="2025-06-04T16:46:19Z"` level=debug msg="+ /usr/lib/rpm/rpmuncompress /usr/src/mariner/SOURCES/CVE-2024-45310.patch" time="2025-06-04T16:46:19Z" level=debug msg="+ /bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch -f" time="2025-06-04T16:46:19Z" level=debug msg="/bin/patch: **** malformed patch at line 97: diff --git a/vendor/github.com/opencontainers/runc/libcontainer/rootfs_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/rootfs_linux.go" time="2025-06-04T16:46:19Z" level=debug

@v-smalavathu
Copy link
Copy Markdown
Contributor Author

v-smalavathu commented Jun 9, 2025

Investigate Build Failure

time="2025-06-04T16:46:19Z"` level=debug msg="+ /usr/lib/rpm/rpmuncompress /usr/src/mariner/SOURCES/CVE-2024-45310.patch" time="2025-06-04T16:46:19Z" level=debug msg="+ /bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch -f" time="2025-06-04T16:46:19Z" level=debug msg="/bin/patch: **** malformed patch at line 97: diff --git a/vendor/github.com/opencontainers/runc/libcontainer/rootfs_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/rootfs_linux.go" time="2025-06-04T16:46:19Z" level=debug

It was successful that time, Here attaching build and test logs.
kubernetes-1.28.4-18.cm2.src.rpm.log
kubernetes-1.28.4-18.cm2.src.rpm.test.log

@v-smalavathu
Copy link
Copy Markdown
Contributor Author

v-smalavathu commented Jun 10, 2025 •
edited
Loading

@Kanishk-Bansal,
Today, I rebased this PR to latest top of tree and tried to rebuild the package kubernetes from scratch.

Fixed build issues like "Mal function and tampered date in patch file" by re-generate patch file with current date and did changelog with current date. and now, the build is successful.

Here, the snapshots and logs attached.

image

image

image

kubernetes-1.28.4-19.cm2.src.rpm.log

kubernetes-1.28.4-19.cm2.src.rpm.test.log

Kindly let me know if I need to add something here.
-Thanks

@v-smalavathu
Copy link
Copy Markdown
Contributor Author

v-smalavathu commented Jun 18, 2025

@kgodara912,
Updated the patch analysis details.
-Thanks

@v-smalavathu v-smalavathu changed the title [Medium] Patch kubernetes for CVE-2024-45310 [Low] Patch kubernetes for CVE-2024-45310 Jun 18, 2025
@Kanishk-Bansal
Copy link
Copy Markdown
Contributor

Kanishk-Bansal commented Jun 25, 2025

Buddy Build

@v-smalavathu
Copy link
Copy Markdown
Contributor Author

v-smalavathu commented Jun 27, 2025

Buddy Build

Just checked
Build is success
-Thanks

@Malateshk007
Copy link
Copy Markdown

Malateshk007 commented Jul 14, 2025

@kgodara912, please provide your review on this.

@Malateshk007
Copy link
Copy Markdown

Malateshk007 commented Aug 8, 2025

@kgodara912, please provide your review on this.
Gentle reminder!

@Malateshk007
Copy link
Copy Markdown

Malateshk007 commented Sep 8, 2025

@cyberbandya007, gentle reminder for review!

@sandeepkarambelkar
Copy link
Copy Markdown
Contributor

sandeepkarambelkar commented Sep 10, 2025

Hello @v-smalavathu, Can you merge the conflicts once so that I can run buddy build again.

@sallhms
Copy link
Copy Markdown
Contributor

sallhms commented Sep 11, 2025

Need to close this PR in favor of PR #14641

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kgodara912 kgodara912 kgodara912 left review comments

@sandeepkarambelkar sandeepkarambelkar Awaiting requested review from sandeepkarambelkar

Assignees

No one assigned

Labels

main PR Destined for main Packaging security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@v-smalavathu @Kanishk-Bansal @Malateshk007 @sandeepkarambelkar @sallhms @kgodara912