Skip to content

Commit f0ae52b

Browse files
azurelinux-securityarchana25-msjslobodzian
authored
[AutoPR- Security] Patch moby-containerd-cc for CVE-2025-64329, CVE-2024-25621 [HIGH] (microsoft#15069)
Co-authored-by: Archana Shettigar <[email protected]> Co-authored-by: jslobodzian <[email protected]>
1 parent 7582722 commit f0ae52b

File tree

3 files changed

+180
-1
lines changed

3 files changed

+180
-1
lines changed

‎SPECS/moby-containerd-cc/CVE-2024-25621.patch‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
From da0f5007529564b9a9d197b576a775b505bfc2af Mon Sep 17 00:00:00 2001
2+
From: Akihiro Suda <[email protected]>
3+
Date: Mon, 27 Oct 2025 16:42:59 +0900
4+
Subject: [PATCH] Fix directory permissions
5+
6+
- Create /var/lib/containerd with 0o700 (was: 0o711).
7+
- Create config.TempDir with 0o700 (was: 0o711).
8+
- Create /run/containerd/io.containerd.grpc.v1.cri with 0o700 (was: 0o755).
9+
- Create /run/containerd/io.containerd.sandbox.controller.v1.shim with 0o700 (was: 0o711).
10+
- Leave /run/containerd and /run/containerd/io.containerd.runtime.v2.task created with 0o711,
11+
as required by userns-remapped containers.
12+
/run/containerd/io.containerd.runtime.v2.task/<NS>/<ID> is created with:
13+
- 0o700 for non-userns-remapped containers
14+
- 0o710 for userns-remapped containers with the remapped root group as the owner group.
15+
16+
Signed-off-by: AllSpark <[email protected]>
17+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
18+
Upstream-reference: AI Backport of https://github.com/containerd/containerd/commit/0450f046e6942e513d0ebf1ef5c2aff13daa187f.patch
19+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
20+
Upstream-reference: https://raw.githubusercontent.com/microsoft/azurelinux/79d629e86579f82f49940591633f4eae98cb0413/SPECS/moby-containerd-cc/CVE-2024-25621.patch
21+
---
22+
pkg/cri/cri.go | 8 ++++++++
23+
runtime/v2/manager.go | 2 ++
24+
services/server/server.go | 14 ++++++++++++--
25+
3 files changed, 22 insertions(+), 2 deletions(-)
26+
27+
diff --git a/pkg/cri/cri.go b/pkg/cri/cri.go
28+
index aa57313..55db3a2 100644
29+
--- a/pkg/cri/cri.go
30+
+++ b/pkg/cri/cri.go
31+
@@ -62,6 +62,14 @@ func initCRIService(ic *plugin.InitContext) (interface{}, error) {
32+
return nil, fmt.Errorf("invalid plugin config: %w", err)
33+
}
34+
35+
+ if err := os.MkdirAll(ic.State, 0700); err != nil {
36+
+ return nil, err
37+
+ }
38+
+ // chmod is needed for upgrading from an older release that created the dir with 0755
39+
+ if err := os.Chmod(ic.State, 0700); err != nil {
40+
+ return nil, err
41+
+ }
42+
+
43+
c := criconfig.Config{
44+
PluginConfig: *pluginConfig,
45+
ContainerdRootDir: filepath.Dir(ic.Root),
46+
diff --git a/runtime/v2/manager.go b/runtime/v2/manager.go
47+
index 73e1af7..d48ac8f 100644
48+
--- a/runtime/v2/manager.go
49+
+++ b/runtime/v2/manager.go
50+
@@ -133,6 +133,8 @@ type ManagerConfig struct {
51+
// NewShimManager creates a manager for v2 shims
52+
func NewShimManager(ctx context.Context, config *ManagerConfig) (*ShimManager, error) {
53+
for _, d := range []string{config.Root, config.State} {
54+
+ // root: the parent of this directory is created as 0700, not 0711.
55+
+ // state: the parent of this directory is created as 0711 too, so as to support userns-remapped containers.
56+
if err := os.MkdirAll(d, 0711); err != nil {
57+
return nil, err
58+
}
59+
diff --git a/services/server/server.go b/services/server/server.go
60+
index 2a548ef..04782bf 100644
61+
--- a/services/server/server.go
62+
+++ b/services/server/server.go
63+
@@ -76,12 +76,22 @@ func CreateTopLevelDirectories(config *srvconfig.Config) error {
64+
return err
65+
}
66+
67+
- if err := sys.MkdirAllWithACL(config.State, 0711); err != nil {
68+
+ if err := sys.MkdirAllWithACL(config.Root, 0700); err != nil {
69+
+ return err
70+
+ }
71+
+ // chmod is needed for upgrading from an older release that created the dir with 0o711
72+
+ if err := os.Chmod(config.Root, 0700); err != nil {
73+
return err
74+
}
75+
76+
+ // For supporting userns-remapped containers, the state dir cannot be just mkdired with 0o700.
77+
+ // Each of plugins creates a dedicated directory beneath the state dir with appropriate permission bits.
78+
if config.TempDir != "" {
79+
- if err := sys.MkdirAllWithACL(config.TempDir, 0711); err != nil {
80+
+ if err := sys.MkdirAllWithACL(config.TempDir, 0700); err != nil {
81+
+ return err
82+
+ }
83+
+ // chmod is needed for upgrading from an older release that created the dir with 0o711
84+
+ if err := os.Chmod(config.Root, 0700); err != nil {
85+
return err
86+
}
87+
if runtime.GOOS == "windows" {
88+
--
89+
2.45.4
90+

‎SPECS/moby-containerd-cc/CVE-2025-64329.patch‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
From 851a45118b51c831f1496c6621e99a319eefe591 Mon Sep 17 00:00:00 2001
2+
From: AllSpark <[email protected]>
3+
Date: Wed, 12 Nov 2025 12:01:36 +0000
4+
Subject: [PATCH] fix goroutine leak of container Attach
5+
6+
The monitor goroutine (runs (*ContainerIO).Attach.func1) of Attach will
7+
never finish if it attaches to a container without any stdout or stderr
8+
output. Wait for http context cancel and break the pipe actively to
9+
address the issue.
10+
11+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
12+
Upstream-reference: AI Backport of https://github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612df.patch
13+
---
14+
pkg/cri/io/container_io.go | 14 +++++++++++---
15+
pkg/cri/sbserver/container_attach.go | 2 +-
16+
pkg/cri/server/container_attach.go | 2 +-
17+
3 files changed, 13 insertions(+), 5 deletions(-)
18+
19+
diff --git a/pkg/cri/io/container_io.go b/pkg/cri/io/container_io.go
20+
index 70bc8b7..e158410 100644
21+
--- a/pkg/cri/io/container_io.go
22+
+++ b/pkg/cri/io/container_io.go
23+
@@ -17,6 +17,7 @@
24+
package io
25+
26+
import (
27+
+ "context"
28+
"errors"
29+
"io"
30+
"strings"
31+
@@ -134,7 +135,7 @@ func (c *ContainerIO) Pipe() {
32+
33+
// Attach attaches container stdio.
34+
// TODO(random-liu): Use pools.Copy in docker to reduce memory usage?
35+
-func (c *ContainerIO) Attach(opts AttachOptions) {
36+
+func (c *ContainerIO) Attach(ctx context.Context, opts AttachOptions) {
37+
var wg sync.WaitGroup
38+
key := util.GenerateID()
39+
stdinKey := streamKey(c.id, "attach-"+key, Stdin)
40+
@@ -175,8 +176,15 @@ func (c *ContainerIO) Attach(opts AttachOptions) {
41+
}
42+
43+
attachStream := func(key string, close <-chan struct{}) {
44+
- <-close
45+
- logrus.Infof("Attach stream %q closed", key)
46+
+ select {
47+
+ case <-close:
48+
+ logrus.Infof("Attach stream %q closed", key)
49+
+ case <-ctx.Done():
50+
+ logrus.Infof("Attach client of %q cancelled", key)
51+
+ // Avoid writeGroup heap up
52+
+ c.stdoutGroup.Remove(key)
53+
+ c.stderrGroup.Remove(key)
54+
+ }
55+
// Make sure stdin gets closed.
56+
if stdinStreamRC != nil {
57+
stdinStreamRC.Close()
58+
diff --git a/pkg/cri/sbserver/container_attach.go b/pkg/cri/sbserver/container_attach.go
59+
index 56f69c6..b2a534a 100644
60+
--- a/pkg/cri/sbserver/container_attach.go
61+
+++ b/pkg/cri/sbserver/container_attach.go
62+
@@ -79,6 +79,6 @@ func (c *criService) attachContainer(ctx context.Context, id string, stdin io.Re
63+
},
64+
}
65+
// TODO(random-liu): Figure out whether we need to support historical output.
66+
- cntr.IO.Attach(opts)
67+
+ cntr.IO.Attach(ctx, opts)
68+
return nil
69+
}
70+
diff --git a/pkg/cri/server/container_attach.go b/pkg/cri/server/container_attach.go
71+
index cd79f3b..aa6519a 100644
72+
--- a/pkg/cri/server/container_attach.go
73+
+++ b/pkg/cri/server/container_attach.go
74+
@@ -79,6 +79,6 @@ func (c *criService) attachContainer(ctx context.Context, id string, stdin io.Re
75+
},
76+
}
77+
// TODO(random-liu): Figure out whether we need to support historical output.
78+
- cntr.IO.Attach(opts)
79+
+ cntr.IO.Attach(ctx, opts)
80+
return nil
81+
}
82+
--
83+
2.45.4
84+

‎SPECS/moby-containerd-cc/moby-containerd-cc.spec‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
Summary: Industry-standard container runtime for confidential containers
77
Name: moby-%{upstream_name}
88
Version: 1.7.7
9-
Release: 12%{?dist}
9+
Release: 13%{?dist}
1010
License: ASL 2.0
1111
Group: Tools/Container
1212
URL: https://www.containerd.io
@@ -24,6 +24,8 @@ Patch5: CVE-2024-24786.patch
2424
Patch6: CVE-2024-28180.patch
2525
Patch7: CVE-2025-27144.patch
2626
Patch8: CVE-2024-40635.patch
27+
Patch9: CVE-2024-25621.patch
28+
Patch10:CVE-2025-64329.patch
2729

2830
%{?systemd_requires}
2931

@@ -84,6 +86,9 @@ fi
8486
%config(noreplace) %{_sysconfdir}/containerd/config.toml
8587

8688
%changelog
89+
* Wed Nov 12 2025 Azure Linux Security Servicing Account <[email protected]> - 1.7.7-13
90+
- Patch for CVE-2025-64329, CVE-2024-25621
91+
8792
* Thu Sep 04 2025 Akhila Guruju <[email protected]> - 1.7.7-12
8893
- Bump release to rebuild with golang
8994

0 commit comments

Comments
 (0)