[Low] Patch kubernetes for CVE-2024-45310#14641
Conversation
Signed-off-by: Sreenivasulu Malavathula <v-smalavathu@microsoft.com>
This reverts commit 21e8c55.
SumitJenaHCL
changed the title
| } | ||
| + | ||
| +// syscallMode returns the syscall-specific mode bits from Go's portable mode bits. | ||
| +func syscallMode(i fs.FileMode) (o uint32) { |
There was a problem hiding this comment.
reference added above as per earlier request in the previous PR,
| - return err | ||
| - } | ||
| - | ||
| - if stat != nil { |
There was a problem hiding this comment.
As per GHSA-jfvp-7x6p-h2pv for Release-1.1, I don't see this change in any of the 2 patches:
opencontainers/runc@8781993, or
opencontainers/runc@f0b652e#diff-e0932af06cb46065b2ef5fc89bc2bd9b880c9578e01b89ef4ecaeffb78a8bef0
Please explain this.
There was a problem hiding this comment.
Changes are added in order to backport mountToRootfs from v1.1
| +// Taken from <include/linux/proc_ns.h>. If a file is on a filesystem of type | ||
| +// PROC_SUPER_MAGIC, we're guaranteed that only the root of the superblock will | ||
| +// have this inode number. | ||
| +const procRootIno = 1 |
There was a problem hiding this comment.
Why did we need this change? I understand that the function argument number has changed in the upstream patches.
Can you provide details of the commit from which we have taken these changes?
There was a problem hiding this comment.
Changes are added in order to backport getCgroupMounts from v1.1
4 participants
Merge Checklist
All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)
*-staticsubpackages, etc.) have had theirReleasetag incremented../cgmanifest.json,./toolkit/scripts/toolchain/cgmanifest.json,.github/workflows/cgmanifest.json)./LICENSES-AND-NOTICES/SPECS/data/licenses.json,./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md,./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)*.signatures.jsonfilessudo make go-tidy-allandsudo make go-test-coveragepassSummary
What does the PR accomplish, why was it needed?
kubernetes: Patch for GHSA-jfvp-7x6p-h2pv
Patch Modified – Yes
-- Taken Patches from NIST:
-- opencontainers/runc@f0b652e,
-- opencontainers/runc@8781993
-- https://cs.opensource.google/go/go/+/refs/tags/go1.20.7:src/os/file_posix.go;l=61-75
Astrolabe Patch "opencontainers/runc#4359" is incorrect.
Change Log
Does this affect the toolchain?
NO
Associated issues
Links to CVEs
Test Methodology