* [meta-virtualization] [scarthgap] [PATCH] docker-moby 25.0.3: fix CVE-2024-36623 @ 2025-07-17 18:05 Sudhir Dumbhare 2025-07-21 2:37 ` Bruce Ashfield 0 siblings, 1 reply; 12+ messages in thread From: Sudhir Dumbhare @ 2025-07-17 18:05 UTC (permalink / raw) To: meta-virtualization; +Cc: xe-linux-external, sudumbha [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain; charset=y, Size: 3710 bytes --] Upstream Repository: https://github.com/moby/moby.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2024-36623 Type: Security Fix CVE: CVE-2024-36623 Score: 8.1 Patch: https://github.com/moby/moby/commit/8e3bcf197488 Analysis: - Moby through v25.0.3 has a race condition vulnerability in the streamformatter package. It can trigger multiple concurrent write operations resulting in data corruption. [1] - The fix adds a mutex to prevent concurrent writes and protect against data corruption. [2] Reference: [1] https://nvd.nist.gov/vuln/detail/CVE-2024-36623 [2] https://github.com/moby/moby/commit/8e3bcf197488 Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> --- recipes-containers/docker/docker-moby_git.bb | 1 + .../docker/files/CVE-2024-36623.patch | 55 +++++++++++++++++++ 2 files changed, 56 insertions(+) create mode 100644 recipes-containers/docker/files/CVE-2024-36623.patch diff --git a/recipes-containers/docker/docker-moby_git.bb b/recipes-containers/docker/docker-moby_git.bb index aa239f68..d40e3e17 100644 --- a/recipes-containers/docker/docker-moby_git.bb +++ b/recipes-containers/docker/docker-moby_git.bb @@ -60,6 +60,7 @@ SRC_URI = "\ file://CVE-2024-36621.patch;patchdir=src/import \ file://CVE-2024-29018_p1.patch;patchdir=src/import \ file://CVE-2024-29018_p2.patch;patchdir=src/import \ + file://CVE-2024-36623.patch;patchdir=src/import \ " DOCKER_COMMIT = "${SRCREV_moby}" diff --git a/recipes-containers/docker/files/CVE-2024-36623.patch b/recipes-containers/docker/files/CVE-2024-36623.patch new file mode 100644 index 00000000..811a37d7 --- /dev/null +++ b/recipes-containers/docker/files/CVE-2024-36623.patch @@ -0,0 +1,55 @@ +From 595fb34dbb46105379b469abfb70f7f9228c9361 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pawe=C5=82=20Gronowski?= <pawel.gronowski@docker.com> +Date: Thu, 22 Feb 2024 18:01:40 +0100 +Subject: [PATCH] pkg/streamformatter: Make `progressOutput` concurrency safe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Sync access to the underlying `io.Writer` with a mutex. + +Upstream-Status: Backport [https://github.com/moby/moby/commit/8e3bcf197488] +CVE: CVE-2024-36623 + +Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com> +(cherry picked from commit 5689dabfb357b673abdb4391eef426f297d7d1bb) +Signed-off-by: Albin Kerouanton <albinker@gmail.com> +(cherry picked from commit 8e3bcf19748838b30e34d612832d1dc9d90363b8) +Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> +--- + pkg/streamformatter/streamformatter.go | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/pkg/streamformatter/streamformatter.go b/pkg/streamformatter/streamformatter.go +index b0456e580d..098df6b523 100644 +--- a/pkg/streamformatter/streamformatter.go ++++ b/pkg/streamformatter/streamformatter.go +@@ -5,6 +5,7 @@ import ( + "encoding/json" + "fmt" + "io" ++ "sync" + + "github.com/docker/docker/pkg/jsonmessage" + "github.com/docker/docker/pkg/progress" +@@ -109,6 +110,7 @@ type progressOutput struct { + sf formatProgress + out io.Writer + newLines bool ++ mu sync.Mutex + } + + // WriteProgress formats progress information from a ProgressReader. +@@ -120,6 +122,9 @@ func (out *progressOutput) WriteProgress(prog progress.Progress) error { + jsonProgress := jsonmessage.JSONProgress{Current: prog.Current, Total: prog.Total, HideCounts: prog.HideCounts, Units: prog.Units} + formatted = out.sf.formatProgress(prog.ID, prog.Action, &jsonProgress, prog.Aux) + } ++ ++ out.mu.Lock() ++ defer out.mu.Unlock() + _, err := out.out.Write(formatted) + if err != nil { + return err +-- +2.44.1 + -- 2.35.6 ^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [meta-virtualization] [scarthgap] [PATCH] docker-moby 25.0.3: fix CVE-2024-36623 2025-07-17 18:05 [meta-virtualization] [scarthgap] [PATCH] docker-moby 25.0.3: fix CVE-2024-36623 Sudhir Dumbhare @ 2025-07-21 2:37 ` Bruce Ashfield 2025-07-21 10:17 ` Sudhir Dumbhare 0 siblings, 1 reply; 12+ messages in thread From: Bruce Ashfield @ 2025-07-21 2:37 UTC (permalink / raw) To: sudumbha; +Cc: meta-virtualization, xe-linux-external This patch is coming through garbled: [/home/bruc...]> git am -s ~/incoming/0003-_meta-virtualization_scarthgap_PATCH_docker-moby_25.0.3_fix_CVE-2024-3.patch Patch format detection failed. Bruce In message: [meta-virtualization] [scarthgap] [PATCH] docker-moby 25.0.3: fix CVE-2024-36623 on 17/07/2025 Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.yoctoproject.org wrote: > Upstream Repository: https://github.com/moby/moby.git > > Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2024-36623 > Type: Security Fix > CVE: CVE-2024-36623 > Score: 8.1 > Patch: https://github.com/moby/moby/commit/8e3bcf197488 > > Analysis: > - Moby through v25.0.3 has a race condition vulnerability in the > streamformatter package. It can trigger multiple concurrent write > operations resulting in data corruption. [1] > - The fix adds a mutex to prevent concurrent writes and protect against > data corruption. [2] > > Reference: > [1] https://nvd.nist.gov/vuln/detail/CVE-2024-36623 > [2] https://github.com/moby/moby/commit/8e3bcf197488 > > Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> > --- > recipes-containers/docker/docker-moby_git.bb | 1 + > .../docker/files/CVE-2024-36623.patch | 55 +++++++++++++++++++ > 2 files changed, 56 insertions(+) > create mode 100644 recipes-containers/docker/files/CVE-2024-36623.patch > > diff --git a/recipes-containers/docker/docker-moby_git.bb b/recipes-containers/docker/docker-moby_git.bb > index aa239f68..d40e3e17 100644 > --- a/recipes-containers/docker/docker-moby_git.bb > +++ b/recipes-containers/docker/docker-moby_git.bb > @@ -60,6 +60,7 @@ SRC_URI = "\ > file://CVE-2024-36621.patch;patchdir=src/import \ > file://CVE-2024-29018_p1.patch;patchdir=src/import \ > file://CVE-2024-29018_p2.patch;patchdir=src/import \ > + file://CVE-2024-36623.patch;patchdir=src/import \ > " > > DOCKER_COMMIT = "${SRCREV_moby}" > diff --git a/recipes-containers/docker/files/CVE-2024-36623.patch b/recipes-containers/docker/files/CVE-2024-36623.patch > new file mode 100644 > index 00000000..811a37d7 > --- /dev/null > +++ b/recipes-containers/docker/files/CVE-2024-36623.patch > @@ -0,0 +1,55 @@ > +From 595fb34dbb46105379b469abfb70f7f9228c9361 Mon Sep 17 00:00:00 2001 > +From: =?UTF-8?q?Pawe=C5=82=20Gronowski?= <pawel.gronowski@docker.com> > +Date: Thu, 22 Feb 2024 18:01:40 +0100 > +Subject: [PATCH] pkg/streamformatter: Make `progressOutput` concurrency safe > +MIME-Version: 1.0 > +Content-Type: text/plain; charset=UTF-8 > +Content-Transfer-Encoding: 8bit > + > +Sync access to the underlying `io.Writer` with a mutex. > + > +Upstream-Status: Backport [https://github.com/moby/moby/commit/8e3bcf197488] > +CVE: CVE-2024-36623 > + > +Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com> > +(cherry picked from commit 5689dabfb357b673abdb4391eef426f297d7d1bb) > +Signed-off-by: Albin Kerouanton <albinker@gmail.com> > +(cherry picked from commit 8e3bcf19748838b30e34d612832d1dc9d90363b8) > +Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> > +--- > + pkg/streamformatter/streamformatter.go | 5 +++++ > + 1 file changed, 5 insertions(+) > + > +diff --git a/pkg/streamformatter/streamformatter.go b/pkg/streamformatter/streamformatter.go > +index b0456e580d..098df6b523 100644 > +--- a/pkg/streamformatter/streamformatter.go > ++++ b/pkg/streamformatter/streamformatter.go > +@@ -5,6 +5,7 @@ import ( > + "encoding/json" > + "fmt" > + "io" > ++ "sync" > + > + "github.com/docker/docker/pkg/jsonmessage" > + "github.com/docker/docker/pkg/progress" > +@@ -109,6 +110,7 @@ type progressOutput struct { > + sf formatProgress > + out io.Writer > + newLines bool > ++ mu sync.Mutex > + } > + > + // WriteProgress formats progress information from a ProgressReader. > +@@ -120,6 +122,9 @@ func (out *progressOutput) WriteProgress(prog progress.Progress) error { > + jsonProgress := jsonmessage.JSONProgress{Current: prog.Current, Total: prog.Total, HideCounts: prog.HideCounts, Units: prog.Units} > + formatted = out.sf.formatProgress(prog.ID, prog.Action, &jsonProgress, prog.Aux) > + } > ++ > ++ out.mu.Lock() > ++ defer out.mu.Unlock() > + _, err := out.out.Write(formatted) > + if err != nil { > + return err > +-- > +2.44.1 > + > -- > 2.35.6 > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#9318): https://lists.yoctoproject.org/g/meta-virtualization/message/9318 > Mute This Topic: https://lists.yoctoproject.org/mt/114208293/1050810 > Group Owner: meta-virtualization+owner@lists.yoctoproject.org > Unsubscribe: https://lists.yoctoproject.org/g/meta-virtualization/unsub [bruce.ashfield@gmail.com] > -=-=-=-=-=-=-=-=-=-=-=- > ^ permalink raw reply [flat|nested] 12+ messages in thread
* [meta-virtualization] [scarthgap] [PATCH] docker-moby 25.0.3: fix CVE-2024-36623 2025-07-21 2:37 ` Bruce Ashfield @ 2025-07-21 10:17 ` Sudhir Dumbhare 2025-07-31 17:41 ` Bruce Ashfield 0 siblings, 1 reply; 12+ messages in thread From: Sudhir Dumbhare @ 2025-07-21 10:17 UTC (permalink / raw) To: meta-virtualization; +Cc: xe-linux-external, vchavda Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2024-36623 Type: Security Fix CVE: CVE-2024-36623 Score: 8.1 Patch: https://github.com/moby/moby/commit/8e3bcf197488 Analysis: - Moby through v25.0.3 has a race condition vulnerability in the streamformatter package. It can trigger multiple concurrent write operations resulting in data corruption. [1] - The fix adds a mutex to prevent concurrent writes and protect against data corruption. [2] Reference: [1] https://nvd.nist.gov/vuln/detail/CVE-2024-36623 [2] https://github.com/moby/moby/commit/8e3bcf197488 Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> --- recipes-containers/docker/docker-moby_git.bb | 1 + .../docker/files/CVE-2024-36623.patch | 47 +++++++++++++++++++ 2 files changed, 48 insertions(+) create mode 100644 recipes-containers/docker/files/CVE-2024-36623.patch diff --git a/recipes-containers/docker/docker-moby_git.bb b/recipes-containers/docker/docker-moby_git.bb index aa239f68..d40e3e17 100644 --- a/recipes-containers/docker/docker-moby_git.bb +++ b/recipes-containers/docker/docker-moby_git.bb @@ -60,6 +60,7 @@ SRC_URI = "\ file://CVE-2024-36621.patch;patchdir=src/import \ file://CVE-2024-29018_p1.patch;patchdir=src/import \ file://CVE-2024-29018_p2.patch;patchdir=src/import \ + file://CVE-2024-36623.patch;patchdir=src/import \ " DOCKER_COMMIT = "${SRCREV_moby}" diff --git a/recipes-containers/docker/files/CVE-2024-36623.patch b/recipes-containers/docker/files/CVE-2024-36623.patch new file mode 100644 index 00000000..28553c3e --- /dev/null +++ b/recipes-containers/docker/files/CVE-2024-36623.patch @@ -0,0 +1,47 @@ +commit 5becb76fa5a5cb9de135b82017dbc7da7d345614 +Author: Paweł Gronowski <pawel.gronowski@docker.com> +Date: Thu Feb 22 18:01:40 2024 +0100 + + pkg/streamformatter: Make `progressOutput` concurrency safe + + Sync access to the underlying `io.Writer` with a mutex. + + Upstream-Status: Backport [https://github.com/moby/moby/commit/8e3bcf197488] + CVE: CVE-2024-36623 + + Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com> + (cherry picked from commit 5689dabfb357b673abdb4391eef426f297d7d1bb) + Signed-off-by: Albin Kerouanton <albinker@gmail.com> + (cherry picked from commit 8e3bcf19748838b30e34d612832d1dc9d90363b8) + Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> + +diff --git a/pkg/streamformatter/streamformatter.go b/pkg/streamformatter/streamformatter.go +index b0456e580d..098df6b523 100644 +--- a/pkg/streamformatter/streamformatter.go ++++ b/pkg/streamformatter/streamformatter.go +@@ -5,6 +5,7 @@ import ( + "encoding/json" + "fmt" + "io" ++ "sync" + + "github.com/docker/docker/pkg/jsonmessage" + "github.com/docker/docker/pkg/progress" +@@ -109,6 +110,7 @@ type progressOutput struct { + sf formatProgress + out io.Writer + newLines bool ++ mu sync.Mutex + } + + // WriteProgress formats progress information from a ProgressReader. +@@ -120,6 +122,9 @@ func (out *progressOutput) WriteProgress(prog progress.Progress) error { + jsonProgress := jsonmessage.JSONProgress{Current: prog.Current, Total: prog.Total, HideCounts: prog.HideCounts, Units: prog.Units} + formatted = out.sf.formatProgress(prog.ID, prog.Action, &jsonProgress, prog.Aux) + } ++ ++ out.mu.Lock() ++ defer out.mu.Unlock() + _, err := out.out.Write(formatted) + if err != nil { + return err -- 2.23.1 ^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [meta-virtualization] [scarthgap] [PATCH] docker-moby 25.0.3: fix CVE-2024-36623 2025-07-21 10:17 ` Sudhir Dumbhare @ 2025-07-31 17:41 ` Bruce Ashfield 2025-07-31 19:43 ` Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) 0 siblings, 1 reply; 12+ messages in thread From: Bruce Ashfield @ 2025-07-31 17:41 UTC (permalink / raw) To: sudumbha; +Cc: meta-virtualization, xe-linux-external, vchavda [-- Attachment #1: Type: text/plain, Size: 4882 bytes --] Sorry for the slow reply, I've been working on package uprevs for the M3 builds and am just getting to this now. How are you sending this patch ? It is still failing patch detection by git am , so I can't apply it to the tree. Bruce On Mon, Jul 21, 2025 at 6:19 AM Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.yoctoproject.org <sudumbha= cisco.com@lists.yoctoproject.org> wrote: > Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2024-36623 > Type: Security Fix > CVE: CVE-2024-36623 > Score: 8.1 > Patch: https://github.com/moby/moby/commit/8e3bcf197488 > > Analysis: > - Moby through v25.0.3 has a race condition vulnerability in the > streamformatter package. It can trigger multiple concurrent write > operations resulting in data corruption. [1] > - The fix adds a mutex to prevent concurrent writes and protect > against data corruption. [2] > > Reference: > [1] https://nvd.nist.gov/vuln/detail/CVE-2024-36623 > [2] https://github.com/moby/moby/commit/8e3bcf197488 > > Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> > --- > recipes-containers/docker/docker-moby_git.bb | 1 + > .../docker/files/CVE-2024-36623.patch | 47 +++++++++++++++++++ > 2 files changed, 48 insertions(+) > create mode 100644 recipes-containers/docker/files/CVE-2024-36623.patch > > diff --git a/recipes-containers/docker/docker-moby_git.bb > b/recipes-containers/docker/docker-moby_git.bb > index aa239f68..d40e3e17 100644 > --- a/recipes-containers/docker/docker-moby_git.bb > +++ b/recipes-containers/docker/docker-moby_git.bb > @@ -60,6 +60,7 @@ SRC_URI = "\ > file://CVE-2024-36621.patch;patchdir=src/import \ > file://CVE-2024-29018_p1.patch;patchdir=src/import \ > file://CVE-2024-29018_p2.patch;patchdir=src/import \ > + file://CVE-2024-36623.patch;patchdir=src/import \ > " > > DOCKER_COMMIT = "${SRCREV_moby}" > diff --git a/recipes-containers/docker/files/CVE-2024-36623.patch > b/recipes-containers/docker/files/CVE-2024-36623.patch > new file mode 100644 > index 00000000..28553c3e > --- /dev/null > +++ b/recipes-containers/docker/files/CVE-2024-36623.patch > @@ -0,0 +1,47 @@ > +commit 5becb76fa5a5cb9de135b82017dbc7da7d345614 > +Author: Paweł Gronowski <pawel.gronowski@docker.com> > +Date: Thu Feb 22 18:01:40 2024 +0100 > + > + pkg/streamformatter: Make `progressOutput` concurrency safe > + > + Sync access to the underlying `io.Writer` with a mutex. > + > + Upstream-Status: Backport [ > https://github.com/moby/moby/commit/8e3bcf197488] > + CVE: CVE-2024-36623 > + > + Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com> > + (cherry picked from commit 5689dabfb357b673abdb4391eef426f297d7d1bb) > + Signed-off-by: Albin Kerouanton <albinker@gmail.com> > + (cherry picked from commit 8e3bcf19748838b30e34d612832d1dc9d90363b8) > + Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> > + > +diff --git a/pkg/streamformatter/streamformatter.go > b/pkg/streamformatter/streamformatter.go > +index b0456e580d..098df6b523 100644 > +--- a/pkg/streamformatter/streamformatter.go > ++++ b/pkg/streamformatter/streamformatter.go > +@@ -5,6 +5,7 @@ import ( > + "encoding/json" > + "fmt" > + "io" > ++ "sync" > + > + "github.com/docker/docker/pkg/jsonmessage" > + "github.com/docker/docker/pkg/progress" > +@@ -109,6 +110,7 @@ type progressOutput struct { > + sf formatProgress > + out io.Writer > + newLines bool > ++ mu sync.Mutex > + } > + > + // WriteProgress formats progress information from a ProgressReader. > +@@ -120,6 +122,9 @@ func (out *progressOutput) WriteProgress(prog > progress.Progress) error { > + jsonProgress := jsonmessage.JSONProgress{Current: > prog.Current, Total: prog.Total, HideCounts: prog.HideCounts, Units: > prog.Units} > + formatted = out.sf.formatProgress(prog.ID, prog.Action, > &jsonProgress, prog.Aux) > + } > ++ > ++ out.mu.Lock() > ++ defer out.mu.Unlock() > + _, err := out.out.Write(formatted) > + if err != nil { > + return err > -- > 2.23.1 > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#9327): > https://lists.yoctoproject.org/g/meta-virtualization/message/9327 > Mute This Topic: https://lists.yoctoproject.org/mt/114208293/1050810 > Group Owner: meta-virtualization+owner@lists.yoctoproject.org > Unsubscribe: https://lists.yoctoproject.org/g/meta-virtualization/unsub [ > bruce.ashfield@gmail.com] > -=-=-=-=-=-=-=-=-=-=-=- > > -- - Thou shalt not follow the NULL pointer, for chaos and madness await thee at its end - "Use the force Harry" - Gandalf, Star Trek II [-- Attachment #2: Type: text/html, Size: 7907 bytes --] ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [meta-virtualization] [scarthgap] [PATCH] docker-moby 25.0.3: fix CVE-2024-36623 2025-07-31 17:41 ` Bruce Ashfield @ 2025-07-31 19:43 ` Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) 2025-07-31 20:12 ` Bruce Ashfield 0 siblings, 1 reply; 12+ messages in thread From: Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2025-07-31 19:43 UTC (permalink / raw) To: Bruce Ashfield Cc: meta-virtualization@lists.yoctoproject.org, xe-linux-external(mailer list), Viral Chavda (vchavda) [-- Attachment #1: Type: text/plain, Size: 6203 bytes --] A patch is generated using the command $git format-patch -1 HEAD To confirm the patch applies correctly; verify with following sequence: -clone meta-virtualization $git clone git://git.yoctoproject.org/meta-virtualization -switch to the scarthgap branch $git checkout scarthgap -and apply the patch $git am 0001-docker-moby-25.0.3-fix-CVE-2024-36623.patch Finally, sending the patch via git send-email. please check the patch verified with above sequence. Thanks & Regards, Sudhir ________________________________ From: Bruce Ashfield <bruce.ashfield@gmail.com> Sent: 31 July 2025 23:11 To: Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) <sudumbha@cisco.com> Cc: meta-virtualization@lists.yoctoproject.org <meta-virtualization@lists.yoctoproject.org>; xe-linux-external(mailer list) <xe-linux-external@cisco.com>; Viral Chavda (vchavda) <vchavda@cisco.com> Subject: Re: [meta-virtualization] [scarthgap] [PATCH] docker-moby 25.0.3: fix CVE-2024-36623 Sorry for the slow reply, I've been working on package uprevs for the M3 builds and am just getting to this now. How are you sending this patch ? It is still failing patch detection by git am , so I can't apply it to the tree. Bruce On Mon, Jul 21, 2025 at 6:19 AM Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.yoctoproject.org<http://lists.yoctoproject.org> <sudumbha=cisco.com@lists.yoctoproject.org<mailto:cisco.com@lists.yoctoproject.org>> wrote: Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2024-36623 Type: Security Fix CVE: CVE-2024-36623 Score: 8.1 Patch: https://github.com/moby/moby/commit/8e3bcf197488 Analysis: - Moby through v25.0.3 has a race condition vulnerability in the streamformatter package. It can trigger multiple concurrent write operations resulting in data corruption. [1] - The fix adds a mutex to prevent concurrent writes and protect against data corruption. [2] Reference: [1] https://nvd.nist.gov/vuln/detail/CVE-2024-36623 [2] https://github.com/moby/moby/commit/8e3bcf197488 Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com<mailto:sudumbha@cisco.com>> --- recipes-containers/docker/docker-moby_git.bb<http://docker-moby_git.bb> | 1 + .../docker/files/CVE-2024-36623.patch | 47 +++++++++++++++++++ 2 files changed, 48 insertions(+) create mode 100644 recipes-containers/docker/files/CVE-2024-36623.patch diff --git a/recipes-containers/docker/docker-moby_git.bb<http://docker-moby_git.bb> b/recipes-containers/docker/docker-moby_git.bb<http://docker-moby_git.bb> index aa239f68..d40e3e17 100644 --- a/recipes-containers/docker/docker-moby_git.bb<http://docker-moby_git.bb> +++ b/recipes-containers/docker/docker-moby_git.bb<http://docker-moby_git.bb> @@ -60,6 +60,7 @@ SRC_URI = "\ file://CVE-2024-36621.patch;patchdir=src/import \ file://CVE-2024-29018_p1.patch;patchdir=src/import \ file://CVE-2024-29018_p2.patch;patchdir=src/import \ + file://CVE-2024-36623.patch;patchdir=src/import \ " DOCKER_COMMIT = "${SRCREV_moby}" diff --git a/recipes-containers/docker/files/CVE-2024-36623.patch b/recipes-containers/docker/files/CVE-2024-36623.patch new file mode 100644 index 00000000..28553c3e --- /dev/null +++ b/recipes-containers/docker/files/CVE-2024-36623.patch @@ -0,0 +1,47 @@ +commit 5becb76fa5a5cb9de135b82017dbc7da7d345614 +Author: Paweł Gronowski <pawel.gronowski@docker.com<mailto:pawel.gronowski@docker.com>> +Date: Thu Feb 22 18:01:40 2024 +0100 + + pkg/streamformatter: Make `progressOutput` concurrency safe + + Sync access to the underlying `io.Writer` with a mutex. + + Upstream-Status: Backport [https://github.com/moby/moby/commit/8e3bcf197488] + CVE: CVE-2024-36623 + + Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com<mailto:pawel.gronowski@docker.com>> + (cherry picked from commit 5689dabfb357b673abdb4391eef426f297d7d1bb) + Signed-off-by: Albin Kerouanton <albinker@gmail.com<mailto:albinker@gmail.com>> + (cherry picked from commit 8e3bcf19748838b30e34d612832d1dc9d90363b8) + Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com<mailto:sudumbha@cisco.com>> + +diff --git a/pkg/streamformatter/streamformatter.go b/pkg/streamformatter/streamformatter.go +index b0456e580d..098df6b523 100644 +--- a/pkg/streamformatter/streamformatter.go ++++ b/pkg/streamformatter/streamformatter.go +@@ -5,6 +5,7 @@ import ( + "encoding/json" + "fmt" + "io" ++ "sync" + + "github.com/docker/docker/pkg/jsonmessage<http://github.com/docker/docker/pkg/jsonmessage>" + "github.com/docker/docker/pkg/progress<http://github.com/docker/docker/pkg/progress>" +@@ -109,6 +110,7 @@ type progressOutput struct { + sf formatProgress + out io.Writer + newLines bool ++ mu sync.Mutex + } + + // WriteProgress formats progress information from a ProgressReader. +@@ -120,6 +122,9 @@ func (out *progressOutput) WriteProgress(prog progress.Progress) error { + jsonProgress := jsonmessage.JSONProgress{Current: prog.Current, Total: prog.Total, HideCounts: prog.HideCounts, Units: prog.Units} + formatted = out.sf.formatProgress(prog.ID, prog.Action, &jsonProgress, prog.Aux) + } ++ ++ out.mu.Lock() ++ defer out.mu.Unlock() + _, err := out.out.Write(formatted) + if err != nil { + return err -- 2.23.1 -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#9327): https://lists.yoctoproject.org/g/meta-virtualization/message/9327 Mute This Topic: https://lists.yoctoproject.org/mt/114208293/1050810 Group Owner: meta-virtualization+owner@lists.yoctoproject.org<mailto:meta-virtualization%2Bowner@lists.yoctoproject.org> Unsubscribe: https://lists.yoctoproject.org/g/meta-virtualization/unsub [bruce.ashfield@gmail.com<mailto:bruce.ashfield@gmail.com>] -=-=-=-=-=-=-=-=-=-=-=- -- - Thou shalt not follow the NULL pointer, for chaos and madness await thee at its end - "Use the force Harry" - Gandalf, Star Trek II [-- Attachment #2: Type: text/html, Size: 14798 bytes --] ^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [meta-virtualization] [scarthgap] [PATCH] docker-moby 25.0.3: fix CVE-2024-36623 2025-07-31 19:43 ` Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2025-07-31 20:12 ` Bruce Ashfield 0 siblings, 0 replies; 12+ messages in thread From: Bruce Ashfield @ 2025-07-31 20:12 UTC (permalink / raw) To: Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) Cc: meta-virtualization@lists.yoctoproject.org, xe-linux-external(mailer list), Viral Chavda (vchavda) [-- Attachment #1: Type: text/plain, Size: 7879 bytes --] On Thu, Jul 31, 2025 at 3:43 PM Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) <sudumbha@cisco.com> wrote: > A patch is generated using the command > $git format-patch -1 HEAD > > To confirm the patch applies correctly; > verify with following sequence: > -clone meta-virtualization > $git clone git://git.yoctoproject.org/meta-virtualization > -switch to the scarthgap branch > $git checkout scarthgap > -and apply the patch > $git am 0001-docker-moby-25.0.3-fix-CVE-2024-36623.patch > > Finally, sending the patch via git send-email. > please check the patch verified with above sequence. > I assure you that everything you sent isn't applying, and I've been doing this for several decades now :) Something in your send path is rewriting the patches, in particular the From field. Which makes it an invalid patch. When I edited From: it is valid. I've sent it before, but I can't track it down now .. there's an OpenEmbedded wiki entry on how to fix the From field when sending mail. I suggest searching that up. But your patch also doesn't apply to the top of scarthgap (this is after I edited it). ruce-XPS-8940 [/home/bruc...ualization]> git am -s ~/incoming/0002-_meta-virtualization_scarthgap_PATCH_docker-moby_25.0.3_fix_CVE-2024-3.patch Applying: docker-moby 25.0.3: fix CVE-2024-36623 .git/rebase-apply/patch:47: space before tab in indent. "encoding/json" .git/rebase-apply/patch:48: space before tab in indent. "fmt" .git/rebase-apply/patch:49: space before tab in indent. "io" .git/rebase-apply/patch:51: trailing whitespace. .git/rebase-apply/patch:52: space before tab in indent. "github.com/docker/docker/pkg/jsonmessage" error: patch failed: recipes-containers/docker/docker-moby_git.bb:60 error: recipes-containers/docker/docker-moby_git.bb: patch does not apply Patch failed at 0001 docker-moby 25.0.3: fix CVE-2024-36623 hint: Use 'git am --show-current-patch=diff' to see the failed patch When you have resolved this problem, run "git am --continue". If you prefer to skip this patch, run "git am --skip" instead. To restore the original branch and stop patching, run "git am --abort". Bruce > > Thanks & Regards, > Sudhir > > ------------------------------ > *From:* Bruce Ashfield <bruce.ashfield@gmail.com> > *Sent:* 31 July 2025 23:11 > *To:* Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at > Cisco) <sudumbha@cisco.com> > *Cc:* meta-virtualization@lists.yoctoproject.org < > meta-virtualization@lists.yoctoproject.org>; xe-linux-external(mailer > list) <xe-linux-external@cisco.com>; Viral Chavda (vchavda) < > vchavda@cisco.com> > *Subject:* Re: [meta-virtualization] [scarthgap] [PATCH] docker-moby > 25.0.3: fix CVE-2024-36623 > > Sorry for the slow reply, I've been working on package uprevs for the M3 > builds and am just getting to this now. > > How are you sending this patch ? It is still failing patch detection by > git am , so I can't apply it to the tree. > > Bruce > > On Mon, Jul 21, 2025 at 6:19 AM Sudhir Dumbhare -X (sudumbha - E INFOCHIPS > PRIVATE LIMITED at Cisco) via lists.yoctoproject.org <sudumbha= > cisco.com@lists.yoctoproject.org> wrote: > > Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2024-36623 > Type: Security Fix > CVE: CVE-2024-36623 > Score: 8.1 > Patch: https://github.com/moby/moby/commit/8e3bcf197488 > > Analysis: > - Moby through v25.0.3 has a race condition vulnerability in the > streamformatter package. It can trigger multiple concurrent write > operations resulting in data corruption. [1] > - The fix adds a mutex to prevent concurrent writes and protect > against data corruption. [2] > > Reference: > [1] https://nvd.nist.gov/vuln/detail/CVE-2024-36623 > [2] https://github.com/moby/moby/commit/8e3bcf197488 > > Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> > --- > recipes-containers/docker/docker-moby_git.bb | 1 + > .../docker/files/CVE-2024-36623.patch | 47 +++++++++++++++++++ > 2 files changed, 48 insertions(+) > create mode 100644 recipes-containers/docker/files/CVE-2024-36623.patch > > diff --git a/recipes-containers/docker/docker-moby_git.bb > b/recipes-containers/docker/docker-moby_git.bb > index aa239f68..d40e3e17 100644 > --- a/recipes-containers/docker/docker-moby_git.bb > +++ b/recipes-containers/docker/docker-moby_git.bb > @@ -60,6 +60,7 @@ SRC_URI = "\ > file://CVE-2024-36621.patch;patchdir=src/import \ > file://CVE-2024-29018_p1.patch;patchdir=src/import \ > file://CVE-2024-29018_p2.patch;patchdir=src/import \ > + file://CVE-2024-36623.patch;patchdir=src/import \ > " > > DOCKER_COMMIT = "${SRCREV_moby}" > diff --git a/recipes-containers/docker/files/CVE-2024-36623.patch > b/recipes-containers/docker/files/CVE-2024-36623.patch > new file mode 100644 > index 00000000..28553c3e > --- /dev/null > +++ b/recipes-containers/docker/files/CVE-2024-36623.patch > @@ -0,0 +1,47 @@ > +commit 5becb76fa5a5cb9de135b82017dbc7da7d345614 > +Author: Paweł Gronowski <pawel.gronowski@docker.com> > +Date: Thu Feb 22 18:01:40 2024 +0100 > + > + pkg/streamformatter: Make `progressOutput` concurrency safe > + > + Sync access to the underlying `io.Writer` with a mutex. > + > + Upstream-Status: Backport [ > https://github.com/moby/moby/commit/8e3bcf197488] > + CVE: CVE-2024-36623 > + > + Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com> > + (cherry picked from commit 5689dabfb357b673abdb4391eef426f297d7d1bb) > + Signed-off-by: Albin Kerouanton <albinker@gmail.com> > + (cherry picked from commit 8e3bcf19748838b30e34d612832d1dc9d90363b8) > + Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> > + > +diff --git a/pkg/streamformatter/streamformatter.go > b/pkg/streamformatter/streamformatter.go > +index b0456e580d..098df6b523 100644 > +--- a/pkg/streamformatter/streamformatter.go > ++++ b/pkg/streamformatter/streamformatter.go > +@@ -5,6 +5,7 @@ import ( > + "encoding/json" > + "fmt" > + "io" > ++ "sync" > + > + "github.com/docker/docker/pkg/jsonmessage" > + "github.com/docker/docker/pkg/progress" > +@@ -109,6 +110,7 @@ type progressOutput struct { > + sf formatProgress > + out io.Writer > + newLines bool > ++ mu sync.Mutex > + } > + > + // WriteProgress formats progress information from a ProgressReader. > +@@ -120,6 +122,9 @@ func (out *progressOutput) WriteProgress(prog > progress.Progress) error { > + jsonProgress := jsonmessage.JSONProgress{Current: > prog.Current, Total: prog.Total, HideCounts: prog.HideCounts, Units: > prog.Units} > + formatted = out.sf.formatProgress(prog.ID, prog.Action, > &jsonProgress, prog.Aux) > + } > ++ > ++ out.mu.Lock() > ++ defer out.mu.Unlock() > + _, err := out.out.Write(formatted) > + if err != nil { > + return err > -- > 2.23.1 > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#9327): > https://lists.yoctoproject.org/g/meta-virtualization/message/9327 > Mute This Topic: https://lists.yoctoproject.org/mt/114208293/1050810 > Group Owner: meta-virtualization+owner@lists.yoctoproject.org > Unsubscribe: https://lists.yoctoproject.org/g/meta-virtualization/unsub [ > bruce.ashfield@gmail.com] > -=-=-=-=-=-=-=-=-=-=-=- > > > > -- > - Thou shalt not follow the NULL pointer, for chaos and madness await thee > at its end > - "Use the force Harry" - Gandalf, Star Trek II > > -- - Thou shalt not follow the NULL pointer, for chaos and madness await thee at its end - "Use the force Harry" - Gandalf, Star Trek II [-- Attachment #2: Type: text/html, Size: 17503 bytes --] ^ permalink raw reply [flat|nested] 12+ messages in thread
[parent not found: <PH0PR11MB7496292BBD9BF5D6A0225078D127A@cisco.com>]
* Re: [meta-virtualization] [scarthgap] [PATCH] docker-moby 25.0.3: fix CVE-2024-36623 [not found] <PH0PR11MB7496292BBD9BF5D6A0225078D127A@cisco.com> @ 2025-07-31 19:53 ` sudumbha 0 siblings, 0 replies; 12+ messages in thread From: sudumbha @ 2025-07-31 19:53 UTC (permalink / raw) To: meta-virtualization; +Cc: xe-linux-external, vchavda From: Sudhir Dumbhare <sudumbha@cisco.com> Upstream Repository: https://github.com/moby/moby.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2024-36623 Type: Security Fix CVE: CVE-2024-36623 Score: 8.1 Patch: https://github.com/moby/moby/commit/8e3bcf197488 Analysis: - Moby through v25.0.3 has a race condition vulnerability in the streamformatter package. It can trigger multiple concurrent write operations resulting in data corruption. [1] - The fix adds a mutex to prevent concurrent writes and protect against data corruption. [2] Reference: [1] https://nvd.nist.gov/vuln/detail/CVE-2024-36623 [2] https://github.com/moby/moby/commit/8e3bcf197488 Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> --- recipes-containers/docker/docker-moby_git.bb | 1 + .../docker/files/CVE-2024-36623.patch | 47 +++++++++++++++++++ 2 files changed, 48 insertions(+) create mode 100644 recipes-containers/docker/files/CVE-2024-36623.patch diff --git a/recipes-containers/docker/docker-moby_git.bb b/recipes-containers/docker/docker-moby_git.bb index d274b002..e1ece0fd 100644 --- a/recipes-containers/docker/docker-moby_git.bb +++ b/recipes-containers/docker/docker-moby_git.bb @@ -58,6 +58,7 @@ SRC_URI = "\ file://0001-dynbinary-use-go-cross-compiler.patch;patchdir=src/import \ file://CVE-2024-36620.patch;patchdir=src/import \ file://CVE-2024-36621.patch;patchdir=src/import \ + file://CVE-2024-36623.patch;patchdir=src/import \ " DOCKER_COMMIT = "${SRCREV_moby}" diff --git a/recipes-containers/docker/files/CVE-2024-36623.patch b/recipes-containers/docker/files/CVE-2024-36623.patch new file mode 100644 index 00000000..28553c3e --- /dev/null +++ b/recipes-containers/docker/files/CVE-2024-36623.patch @@ -0,0 +1,47 @@ +commit 5becb76fa5a5cb9de135b82017dbc7da7d345614 +Author: Paweł Gronowski <pawel.gronowski@docker.com> +Date: Thu Feb 22 18:01:40 2024 +0100 + + pkg/streamformatter: Make `progressOutput` concurrency safe + + Sync access to the underlying `io.Writer` with a mutex. + + Upstream-Status: Backport [https://github.com/moby/moby/commit/8e3bcf197488] + CVE: CVE-2024-36623 + + Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com> + (cherry picked from commit 5689dabfb357b673abdb4391eef426f297d7d1bb) + Signed-off-by: Albin Kerouanton <albinker@gmail.com> + (cherry picked from commit 8e3bcf19748838b30e34d612832d1dc9d90363b8) + Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> + +diff --git a/pkg/streamformatter/streamformatter.go b/pkg/streamformatter/streamformatter.go +index b0456e580d..098df6b523 100644 +--- a/pkg/streamformatter/streamformatter.go ++++ b/pkg/streamformatter/streamformatter.go +@@ -5,6 +5,7 @@ import ( + "encoding/json" + "fmt" + "io" ++ "sync" + + "github.com/docker/docker/pkg/jsonmessage" + "github.com/docker/docker/pkg/progress" +@@ -109,6 +110,7 @@ type progressOutput struct { + sf formatProgress + out io.Writer + newLines bool ++ mu sync.Mutex + } + + // WriteProgress formats progress information from a ProgressReader. +@@ -120,6 +122,9 @@ func (out *progressOutput) WriteProgress(prog progress.Progress) error { + jsonProgress := jsonmessage.JSONProgress{Current: prog.Current, Total: prog.Total, HideCounts: prog.HideCounts, Units: prog.Units} + formatted = out.sf.formatProgress(prog.ID, prog.Action, &jsonProgress, prog.Aux) + } ++ ++ out.mu.Lock() ++ defer out.mu.Unlock() + _, err := out.out.Write(formatted) + if err != nil { + return err -- 2.35.6 ^ permalink raw reply related [flat|nested] 12+ messages in thread
[parent not found: <CADkTA4OB4YTqY9_TZjX0YiHsXjaFezoKO1W5x7M1H_PeQ8hV-A@@cisco.com>]
* Re: [meta-virtualization] [scarthgap] [PATCH] docker-moby 25.0.3: fix CVE-2024-36623 [not found] <CADkTA4OB4YTqY9_TZjX0YiHsXjaFezoKO1W5x7M1H_PeQ8hV-A@@cisco.com> @ 2025-07-31 21:31 ` Sudhir Dumbhare 2025-08-04 12:54 ` Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) 0 siblings, 1 reply; 12+ messages in thread From: Sudhir Dumbhare @ 2025-07-31 21:31 UTC (permalink / raw) To: meta-virtualization; +Cc: xe-linux-external, vchavda Upstream Repository: https://github.com/moby/moby.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2024-36623 Type: Security Fix CVE: CVE-2024-36623 Score: 8.1 Patch: https://github.com/moby/moby/commit/8e3bcf197488 Analysis: - Moby through v25.0.3 has a race condition vulnerability in the streamformatter package. It can trigger multiple concurrent write operations resulting in data corruption. [1] - The fix adds a mutex to prevent concurrent writes and protect against data corruption. [2] Reference: [1] https://nvd.nist.gov/vuln/detail/CVE-2024-36623 [2] https://github.com/moby/moby/commit/8e3bcf197488 Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> --- recipes-containers/docker/docker-moby_git.bb | 1 + .../docker/files/CVE-2024-36623.patch | 47 +++++++++++++++++++ 2 files changed, 48 insertions(+) create mode 100644 recipes-containers/docker/files/CVE-2024-36623.patch diff --git a/recipes-containers/docker/docker-moby_git.bb b/recipes-containers/docker/docker-moby_git.bb index d274b002..e1ece0fd 100644 --- a/recipes-containers/docker/docker-moby_git.bb +++ b/recipes-containers/docker/docker-moby_git.bb @@ -58,6 +58,7 @@ SRC_URI = "\ file://0001-dynbinary-use-go-cross-compiler.patch;patchdir=src/import \ file://CVE-2024-36620.patch;patchdir=src/import \ file://CVE-2024-36621.patch;patchdir=src/import \ + file://CVE-2024-36623.patch;patchdir=src/import \ " DOCKER_COMMIT = "${SRCREV_moby}" diff --git a/recipes-containers/docker/files/CVE-2024-36623.patch b/recipes-containers/docker/files/CVE-2024-36623.patch new file mode 100644 index 00000000..28553c3e --- /dev/null +++ b/recipes-containers/docker/files/CVE-2024-36623.patch @@ -0,0 +1,47 @@ +commit 5becb76fa5a5cb9de135b82017dbc7da7d345614 +Author: Paweł Gronowski <pawel.gronowski@docker.com> +Date: Thu Feb 22 18:01:40 2024 +0100 + + pkg/streamformatter: Make `progressOutput` concurrency safe + + Sync access to the underlying `io.Writer` with a mutex. + + Upstream-Status: Backport [https://github.com/moby/moby/commit/8e3bcf197488] + CVE: CVE-2024-36623 + + Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com> + (cherry picked from commit 5689dabfb357b673abdb4391eef426f297d7d1bb) + Signed-off-by: Albin Kerouanton <albinker@gmail.com> + (cherry picked from commit 8e3bcf19748838b30e34d612832d1dc9d90363b8) + Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> + +diff --git a/pkg/streamformatter/streamformatter.go b/pkg/streamformatter/streamformatter.go +index b0456e580d..098df6b523 100644 +--- a/pkg/streamformatter/streamformatter.go ++++ b/pkg/streamformatter/streamformatter.go +@@ -5,6 +5,7 @@ import ( + "encoding/json" + "fmt" + "io" ++ "sync" + + "github.com/docker/docker/pkg/jsonmessage" + "github.com/docker/docker/pkg/progress" +@@ -109,6 +110,7 @@ type progressOutput struct { + sf formatProgress + out io.Writer + newLines bool ++ mu sync.Mutex + } + + // WriteProgress formats progress information from a ProgressReader. +@@ -120,6 +122,9 @@ func (out *progressOutput) WriteProgress(prog progress.Progress) error { + jsonProgress := jsonmessage.JSONProgress{Current: prog.Current, Total: prog.Total, HideCounts: prog.HideCounts, Units: prog.Units} + formatted = out.sf.formatProgress(prog.ID, prog.Action, &jsonProgress, prog.Aux) + } ++ ++ out.mu.Lock() ++ defer out.mu.Unlock() + _, err := out.out.Write(formatted) + if err != nil { + return err -- 2.35.6 ^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [meta-virtualization] [scarthgap] [PATCH] docker-moby 25.0.3: fix CVE-2024-36623 2025-07-31 21:31 ` Sudhir Dumbhare @ 2025-08-04 12:54 ` Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) 2025-08-04 13:04 ` Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) 0 siblings, 1 reply; 12+ messages in thread From: Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2025-08-04 12:54 UTC (permalink / raw) To: meta-virtualization; +Cc: vchavda, deeratho Thank you for the reference. I have reviewed the guidelines at https://docs.yoctoproject.org/dev/contributor-guide/submit-changes.html#fixing-your-from-identity and updated the sendemail.from field as recommended. However, the "From:" header was not visible in the previous message, as it was dropped by the organization's email client. Now resending the patch after properly configuring the field. Thanks & Regards, Sudhir ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [meta-virtualization] [scarthgap] [PATCH] docker-moby 25.0.3: fix CVE-2024-36623 2025-08-04 12:54 ` Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2025-08-04 13:04 ` Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) 2025-08-25 10:57 ` Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) 0 siblings, 1 reply; 12+ messages in thread From: Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2025-08-04 13:04 UTC (permalink / raw) To: meta-virtualization; +Cc: vchavda, deeratho From: Sudhir Dumbhare <sudumbha@cisco.com> Upstream Repository: https://github.com/moby/moby.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2024-36623 Type: Security Fix CVE: CVE-2024-36623 Score: 8.1 Patch: https://github.com/moby/moby/commit/8e3bcf197488 Analysis: - Moby through v25.0.3 has a race condition vulnerability in the streamformatter package. It can trigger multiple concurrent write operations resulting in data corruption. [1] - The fix adds a mutex to prevent concurrent writes and protect against data corruption. [2] Reference: [1] https://nvd.nist.gov/vuln/detail/CVE-2024-36623 [2] https://github.com/moby/moby/commit/8e3bcf197488 Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> --- recipes-containers/docker/docker-moby_git.bb | 1 + .../docker/files/CVE-2024-36623.patch | 47 +++++++++++++++++++ 2 files changed, 48 insertions(+) create mode 100644 recipes-containers/docker/files/CVE-2024-36623.patch diff --git a/recipes-containers/docker/docker-moby_git.bb b/recipes-containers/docker/docker-moby_git.bb index d274b002..e1ece0fd 100644 --- a/recipes-containers/docker/docker-moby_git.bb +++ b/recipes-containers/docker/docker-moby_git.bb @@ -58,6 +58,7 @@ SRC_URI = "\ file://0001-dynbinary-use-go-cross-compiler.patch;patchdir=src/import \ file://CVE-2024-36620.patch;patchdir=src/import \ file://CVE-2024-36621.patch;patchdir=src/import \ + file://CVE-2024-36623.patch;patchdir=src/import \ " DOCKER_COMMIT = "${SRCREV_moby}" diff --git a/recipes-containers/docker/files/CVE-2024-36623.patch b/recipes-containers/docker/files/CVE-2024-36623.patch new file mode 100644 index 00000000..28553c3e --- /dev/null +++ b/recipes-containers/docker/files/CVE-2024-36623.patch @@ -0,0 +1,47 @@ +commit 5becb76fa5a5cb9de135b82017dbc7da7d345614 +Author: Paweł Gronowski <pawel.gronowski@docker.com> +Date: Thu Feb 22 18:01:40 2024 +0100 + + pkg/streamformatter: Make `progressOutput` concurrency safe + + Sync access to the underlying `io.Writer` with a mutex. + + Upstream-Status: Backport [https://github.com/moby/moby/commit/8e3bcf197488] + CVE: CVE-2024-36623 + + Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com> + (cherry picked from commit 5689dabfb357b673abdb4391eef426f297d7d1bb) + Signed-off-by: Albin Kerouanton <albinker@gmail.com> + (cherry picked from commit 8e3bcf19748838b30e34d612832d1dc9d90363b8) + Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> + +diff --git a/pkg/streamformatter/streamformatter.go b/pkg/streamformatter/streamformatter.go +index b0456e580d..098df6b523 100644 +--- a/pkg/streamformatter/streamformatter.go ++++ b/pkg/streamformatter/streamformatter.go +@@ -5,6 +5,7 @@ import ( + "encoding/json" + "fmt" + "io" ++ "sync" + + "github.com/docker/docker/pkg/jsonmessage" + "github.com/docker/docker/pkg/progress" +@@ -109,6 +110,7 @@ type progressOutput struct { + sf formatProgress + out io.Writer + newLines bool ++ mu sync.Mutex + } + + // WriteProgress formats progress information from a ProgressReader. +@@ -120,6 +122,9 @@ func (out *progressOutput) WriteProgress(prog progress.Progress) error { + jsonProgress := jsonmessage.JSONProgress{Current: prog.Current, Total: prog.Total, HideCounts: prog.HideCounts, Units: prog.Units} + formatted = out.sf.formatProgress(prog.ID, prog.Action, &jsonProgress, prog.Aux) + } ++ ++ out.mu.Lock() ++ defer out.mu.Unlock() + _, err := out.out.Write(formatted) + if err != nil { + return err -- 2.35.6 ^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [meta-virtualization] [scarthgap] [PATCH] docker-moby 25.0.3: fix CVE-2024-36623 2025-08-04 13:04 ` Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2025-08-25 10:57 ` Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) 2025-08-25 10:59 ` Bruce Ashfield 0 siblings, 1 reply; 12+ messages in thread From: Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2025-08-25 10:57 UTC (permalink / raw) To: meta-virtualization; +Cc: vchavda, deeratho ping ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [meta-virtualization] [scarthgap] [PATCH] docker-moby 25.0.3: fix CVE-2024-36623 2025-08-25 10:57 ` Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2025-08-25 10:59 ` Bruce Ashfield 0 siblings, 0 replies; 12+ messages in thread From: Bruce Ashfield @ 2025-08-25 10:59 UTC (permalink / raw) To: Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) Cc: meta-virtualization, Viral Chavda (vchavda), deeratho [-- Attachment #1: Type: text/plain, Size: 953 bytes --] The patches are still mangled by the list. I'm on holidays this week, but will see if I can make better suggestions to fix it when I get back. Bruce - Thou shalt not follow the NULL pointer, for chaos and madness await thee at its end - "Use the force Harry" - Gandalf, Star Trek II On Mon, Aug 25, 2025, 7:57 AM Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.yoctoproject.org <sudumbha= cisco.com@lists.yoctoproject.org> wrote: > ping > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#9358): > https://lists.yoctoproject.org/g/meta-virtualization/message/9358 > Mute This Topic: https://lists.yoctoproject.org/mt/114208293/1050810 > Group Owner: meta-virtualization+owner@lists.yoctoproject.org > Unsubscribe: https://lists.yoctoproject.org/g/meta-virtualization/unsub [ > bruce.ashfield@gmail.com] > -=-=-=-=-=-=-=-=-=-=-=- > > [-- Attachment #2: Type: text/html, Size: 2010 bytes --] ^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2025-08-25 10:59 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-07-17 18:05 [meta-virtualization] [scarthgap] [PATCH] docker-moby 25.0.3: fix CVE-2024-36623 Sudhir Dumbhare
2025-07-21 2:37 ` Bruce Ashfield
2025-07-21 10:17 ` Sudhir Dumbhare
2025-07-31 17:41 ` Bruce Ashfield
2025-07-31 19:43 ` Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco)
2025-07-31 20:12 ` Bruce Ashfield
[not found] <PH0PR11MB7496292BBD9BF5D6A0225078D127A@cisco.com>
2025-07-31 19:53 ` sudumbha
[not found] <CADkTA4OB4YTqY9_TZjX0YiHsXjaFezoKO1W5x7M1H_PeQ8hV-A@@cisco.com>
2025-07-31 21:31 ` Sudhir Dumbhare
2025-08-04 12:54 ` Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco)
2025-08-04 13:04 ` Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco)
2025-08-25 10:57 ` Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco)
2025-08-25 10:59 ` Bruce Ashfield
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.