Merge PR "[AUTO-CHERRYPICK] [AutoPR- Security] Patch moby-containerd for CVE-2025-64329, CVE-2024-25621 [HIGH] - branch main" microsoft#15084

Co-authored-by: Azure Linux Security Servicing Account <[email protected]>
Co-authored-by: Archana Shettigar <[email protected]>

Author: 3 people

SPECS/moby-containerd/CVE-2024-25621.patch

@@ -0,0 +1,92 @@
+From 808ae14e2da379e517298396c2242e07d37503ad Mon Sep 17 00:00:00 2001
+From: AllSpark <[email protected]>
+Date: Tue, 11 Nov 2025 11:41:09 +0000
+Subject: [PATCH] Fix directory permissions: make root and tempdir 0o700 with
+ chmod adjustments; keep state at 0o711 for userns; add comments in v2
+ manager;
+
+Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
+Upstream-reference: AI Backport of https://github.com/containerd/containerd/commit/0450f046e6942e513d0ebf1ef5c2aff13daa187f.patch
+Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
+Upstream-reference: https://raw.githubusercontent.com/microsoft/azurelinux/22d76f85edefac1f144ba78ea3b2e4529a238491/SPECS/moby-containerd/CVE-2024-25621.patch
+---
+ pkg/cri/cri.go            |  8 ++++++++
+ runtime/v2/manager.go     |  2 ++
+ services/server/server.go | 14 ++++++++++++--
+ 3 files changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/pkg/cri/cri.go b/pkg/cri/cri.go
+index 59861ed..dee6988 100644
+--- a/pkg/cri/cri.go
++++ b/pkg/cri/cri.go
+@@ -19,6 +19,7 @@ package cri
+ import (
+ 	"flag"
+ 	"fmt"
++	"os"
+ 	"path/filepath"
+ 
+ 	imagespec "github.com/opencontainers/image-spec/specs-go/v1"
+@@ -79,6 +80,13 @@ func initCRIService(ic *plugin.InitContext) (interface{}, error) {
+ 		}
+ 	}
+ 
++	if err := os.MkdirAll(ic.State, 0700); err != nil {
++		return nil, err
++	}
++	// chmod is needed for upgrading from an older release that created the dir with 0755
++	if err := os.Chmod(ic.State, 0700); err != nil {
++		return nil, err
++	}
+ 	c := criconfig.Config{
+ 		PluginConfig:       *pluginConfig,
+ 		ContainerdRootDir:  filepath.Dir(ic.Root),
+diff --git a/runtime/v2/manager.go b/runtime/v2/manager.go
+index 1927cbb..1f26bbe 100644
+--- a/runtime/v2/manager.go
++++ b/runtime/v2/manager.go
+@@ -109,6 +109,8 @@ type ManagerConfig struct {
+ // NewShimManager creates a manager for v2 shims
+ func NewShimManager(ctx context.Context, config *ManagerConfig) (*ShimManager, error) {
+ 	for _, d := range []string{config.Root, config.State} {
++		// root:  the parent of this directory is created as 0700, not 0711.
++		// state: the parent of this directory is created as 0711 too, so as to support userns-remapped containers.
+ 		if err := os.MkdirAll(d, 0711); err != nil {
+ 			return nil, err
+ 		}
+diff --git a/services/server/server.go b/services/server/server.go
+index c2b504c..e707ae4 100644
+--- a/services/server/server.go
++++ b/services/server/server.go
+@@ -86,16 +86,26 @@ func CreateTopLevelDirectories(config *srvconfig.Config) error {
+ 		return errors.New("root and state must be different paths")
+ 	}
+ 
+-	if err := sys.MkdirAllWithACL(config.Root, 0711); err != nil {
++	if err := sys.MkdirAllWithACL(config.Root, 0700); err != nil {
++		return err
++	}
++	// chmod is needed for upgrading from an older release that created the dir with 0o711
++	if err := os.Chmod(config.Root, 0700); err != nil {
+ 		return err
+ 	}
+ 
++	// For supporting userns-remapped containers, the state dir cannot be just mkdired with 0o700.
++	// Each of plugins creates a dedicated directory beneath the state dir with appropriate permission bits.
+ 	if err := sys.MkdirAllWithACL(config.State, 0711); err != nil {
+ 		return err
+ 	}
+ 
+ 	if config.TempDir != "" {
+-		if err := sys.MkdirAllWithACL(config.TempDir, 0711); err != nil {
++		if err := sys.MkdirAllWithACL(config.TempDir, 0700); err != nil {
++			return err
++		}
++		// chmod is needed for upgrading from an older release that created the dir with 0o711
++		if err := os.Chmod(config.Root, 0700); err != nil {
+ 			return err
+ 		}
+ 		if runtime.GOOS == "windows" {
+-- 
+2.45.4
+

SPECS/moby-containerd/CVE-2025-64329.patch

@@ -0,0 +1,67 @@
+From 7c033a088394824e210a647b9597de98485882b7 Mon Sep 17 00:00:00 2001
+From: AllSpark <[email protected]>
+Date: Wed, 12 Nov 2025 11:59:50 +0000
+Subject: [PATCH] fix: avoid goroutine leak in ContainerIO.Attach by respecting
+ context cancellation and breaking pipes; pass ctx from container_attach
+
+Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
+Upstream-reference: AI Backport of https://github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612df.patch
+---
+ pkg/cri/io/container_io.go         | 14 +++++++++++---
+ pkg/cri/server/container_attach.go |  2 +-
+ 2 files changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/pkg/cri/io/container_io.go b/pkg/cri/io/container_io.go
+index 70bc8b7..e158410 100644
+--- a/pkg/cri/io/container_io.go
++++ b/pkg/cri/io/container_io.go
+@@ -17,6 +17,7 @@
+ package io
+ 
+ import (
++	"context"
+ 	"errors"
+ 	"io"
+ 	"strings"
+@@ -134,7 +135,7 @@ func (c *ContainerIO) Pipe() {
+ 
+ // Attach attaches container stdio.
+ // TODO(random-liu): Use pools.Copy in docker to reduce memory usage?
+-func (c *ContainerIO) Attach(opts AttachOptions) {
++func (c *ContainerIO) Attach(ctx context.Context, opts AttachOptions) {
+ 	var wg sync.WaitGroup
+ 	key := util.GenerateID()
+ 	stdinKey := streamKey(c.id, "attach-"+key, Stdin)
+@@ -175,8 +176,15 @@ func (c *ContainerIO) Attach(opts AttachOptions) {
+ 	}
+ 
+ 	attachStream := func(key string, close <-chan struct{}) {
+-		<-close
+-		logrus.Infof("Attach stream %q closed", key)
++		select {
++		case <-close:
++			logrus.Infof("Attach stream %q closed", key)
++		case <-ctx.Done():
++			logrus.Infof("Attach client of %q cancelled", key)
++			// Avoid writeGroup heap up
++			c.stdoutGroup.Remove(key)
++			c.stderrGroup.Remove(key)
++		}
+ 		// Make sure stdin gets closed.
+ 		if stdinStreamRC != nil {
+ 			stdinStreamRC.Close()
+diff --git a/pkg/cri/server/container_attach.go b/pkg/cri/server/container_attach.go
+index a952150..3625229 100644
+--- a/pkg/cri/server/container_attach.go
++++ b/pkg/cri/server/container_attach.go
+@@ -79,6 +79,6 @@ func (c *criService) attachContainer(ctx context.Context, id string, stdin io.Re
+ 		},
+ 	}
+ 	// TODO(random-liu): Figure out whether we need to support historical output.
+-	cntr.IO.Attach(opts)
++	cntr.IO.Attach(ctx, opts)
+ 	return nil
+ }
+-- 
+2.45.4
+

SPECS/moby-containerd/moby-containerd.spec

@@ -5,7 +5,7 @@
 Summary: Industry-standard container runtime
 Name: moby-%{upstream_name}
 Version: 1.6.26
-Release: 12%{?dist}
+Release: 13%{?dist}
 License: ASL 2.0
 Group: Tools/Container
 URL: https://www.containerd.io
@@ -23,6 +23,8 @@ Patch4:  CVE-2024-24786.patch
 Patch5:  CVE-2024-28180.patch
 Patch6:  CVE-2025-27144.patch
 Patch7:  CVE-2024-40635.patch
+Patch8:  CVE-2024-25621.patch
+Patch9:  CVE-2025-64329.patch
 
 %{?systemd_requires}
 
@@ -96,6 +98,9 @@ fi
 %dir /opt/containerd/lib
 
 %changelog
+* Wed Nov 12 2025 Azure Linux Security Servicing Account <[email protected]> - 1.6.26-13
+- Patch for CVE-2025-64329, CVE-2024-25621
+
 * Thu Sep 04 2025 Akhila Guruju <[email protected]> - 1.6.26-12
 - Bump release to rebuild with golang