All of lore.kernel.org
 help / color / mirror / Atom feed
* [meta-virtualization][kirkstone][PATCH 1/2]  containerd-opencontainers: fix CVE-2024-25621
@ 2025-11-10 11:30 vanusuri
  2025-11-10 11:30 ` [meta-virtualization][kirkstone][PATCH 2/2] containerd-opencontainers: fix CVE-2025-64329 vanusuri
  2025-11-19 23:28 ` [meta-virtualization][kirkstone][PATCH 1/2] containerd-opencontainers: fix CVE-2024-25621 Bruce Ashfield
  0 siblings, 2 replies; 6+ messages in thread
From: vanusuri @ 2025-11-10 11:30 UTC (permalink / raw)
  To: meta-virtualization; +Cc: Vijay Anusuri

From: Vijay Anusuri <vanusuri@mvista.com>

Upstream-Status: Backport from https://github.com/containerd/containerd/commit/0450f046e6942e513d0ebf1ef5c2aff13daa187f

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
 .../CVE-2024-25621.patch                      | 103 ++++++++++++++++++
 .../containerd-opencontainers_git.bb          |   1 +
 2 files changed, 104 insertions(+)
 create mode 100644 recipes-containers/containerd/containerd-opencontainers/CVE-2024-25621.patch

diff --git a/recipes-containers/containerd/containerd-opencontainers/CVE-2024-25621.patch b/recipes-containers/containerd/containerd-opencontainers/CVE-2024-25621.patch
new file mode 100644
index 00000000..4ae9bb63
--- /dev/null
+++ b/recipes-containers/containerd/containerd-opencontainers/CVE-2024-25621.patch
@@ -0,0 +1,103 @@
+From 0450f046e6942e513d0ebf1ef5c2aff13daa187f Mon Sep 17 00:00:00 2001
+From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
+Date: Mon, 27 Oct 2025 16:42:59 +0900
+Subject: [PATCH] Fix directory permissions
+
+- Create /var/lib/containerd with 0o700 (was: 0o711).
+- Create config.TempDir with 0o700 (was: 0o711).
+- Create /run/containerd/io.containerd.grpc.v1.cri with 0o700 (was: 0o755).
+- Create /run/containerd/io.containerd.sandbox.controller.v1.shim with 0o700 (was: 0o711).
+- Leave /run/containerd and /run/containerd/io.containerd.runtime.v2.task created with 0o711,
+  as required by userns-remapped containers.
+  /run/containerd/io.containerd.runtime.v2.task/<NS>/<ID> is created with:
+  - 0o700 for non-userns-remapped containers
+  - 0o710 for userns-remapped containers with the remapped root group as the owner group.
+
+Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
+(cherry picked from commit 51b0cf11dc5af7ed1919beba259e644138b28d96)
+Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
+
+Upstream-Status: Backport [https://github.com/containerd/containerd/commit/0450f046e6942e513d0ebf1ef5c2aff13daa187f]
+CVE: CVE-2024-25621
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ pkg/cri/cri.go            |  8 ++++++++
+ runtime/v2/manager.go     |  2 ++
+ services/server/server.go | 14 ++++++++++++--
+ 3 files changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/pkg/cri/cri.go b/pkg/cri/cri.go
+index 7182716b6..dec810196 100644
+--- a/pkg/cri/cri.go
++++ b/pkg/cri/cri.go
+@@ -19,6 +19,7 @@ package cri
+ import (
+ 	"flag"
+ 	"fmt"
++	"os"
+ 	"path/filepath"
+ 
+ 	"github.com/containerd/containerd"
+@@ -68,6 +69,13 @@ func initCRIService(ic *plugin.InitContext) (interface{}, error) {
+ 		return nil, fmt.Errorf("invalid plugin config: %w", err)
+ 	}
+ 
++	if err := os.MkdirAll(ic.State, 0700); err != nil {
++		return nil, err
++	}
++	// chmod is needed for upgrading from an older release that created the dir with 0755
++	if err := os.Chmod(ic.State, 0700); err != nil {
++		return nil, err
++	}
+ 	c := criconfig.Config{
+ 		PluginConfig:       *pluginConfig,
+ 		ContainerdRootDir:  filepath.Dir(ic.Root),
+diff --git a/runtime/v2/manager.go b/runtime/v2/manager.go
+index 1927cbb3f..1f26bbeac 100644
+--- a/runtime/v2/manager.go
++++ b/runtime/v2/manager.go
+@@ -109,6 +109,8 @@ type ManagerConfig struct {
+ // NewShimManager creates a manager for v2 shims
+ func NewShimManager(ctx context.Context, config *ManagerConfig) (*ShimManager, error) {
+ 	for _, d := range []string{config.Root, config.State} {
++		// root:  the parent of this directory is created as 0700, not 0711.
++		// state: the parent of this directory is created as 0711 too, so as to support userns-remapped containers.
+ 		if err := os.MkdirAll(d, 0711); err != nil {
+ 			return nil, err
+ 		}
+diff --git a/services/server/server.go b/services/server/server.go
+index 857cc9c76..bc2ddbf1f 100644
+--- a/services/server/server.go
++++ b/services/server/server.go
+@@ -82,16 +82,26 @@ func CreateTopLevelDirectories(config *srvconfig.Config) error {
+ 		return errors.New("root and state must be different paths")
+ 	}
+ 
+-	if err := sys.MkdirAllWithACL(config.Root, 0711); err != nil {
++	if err := sys.MkdirAllWithACL(config.Root, 0700); err != nil {
++		return err
++	}
++	// chmod is needed for upgrading from an older release that created the dir with 0o711
++	if err := os.Chmod(config.Root, 0700); err != nil {
+ 		return err
+ 	}
+ 
++	// For supporting userns-remapped containers, the state dir cannot be just mkdired with 0o700.
++	// Each of plugins creates a dedicated directory beneath the state dir with appropriate permission bits.
+ 	if err := sys.MkdirAllWithACL(config.State, 0711); err != nil {
+ 		return err
+ 	}
+ 
+ 	if config.TempDir != "" {
+-		if err := sys.MkdirAllWithACL(config.TempDir, 0711); err != nil {
++		if err := sys.MkdirAllWithACL(config.TempDir, 0700); err != nil {
++			return err
++		}
++		// chmod is needed for upgrading from an older release that created the dir with 0o711
++		if err := os.Chmod(config.Root, 0700); err != nil {
+ 			return err
+ 		}
+ 		if runtime.GOOS == "windows" {
+-- 
+2.25.1
+
diff --git a/recipes-containers/containerd/containerd-opencontainers_git.bb b/recipes-containers/containerd/containerd-opencontainers_git.bb
index dd621705..264d37a6 100644
--- a/recipes-containers/containerd/containerd-opencontainers_git.bb
+++ b/recipes-containers/containerd/containerd-opencontainers_git.bb
@@ -10,6 +10,7 @@ SRC_URI = "git://github.com/containerd/containerd;branch=release/1.6;protocol=ht
            file://0001-Makefile-allow-GO_BUILD_FLAGS-to-be-externally-speci.patch \
            file://0001-build-don-t-use-gcflags-to-define-trimpath.patch \
            file://CVE-2024-40635.patch \
+           file://CVE-2024-25621.patch \
           "
 
 # Apache-2.0 for containerd
-- 
2.25.1



^ permalink raw reply related	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2025-12-02  4:46 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-11-10 11:30 [meta-virtualization][kirkstone][PATCH 1/2] containerd-opencontainers: fix CVE-2024-25621 vanusuri
2025-11-10 11:30 ` [meta-virtualization][kirkstone][PATCH 2/2] containerd-opencontainers: fix CVE-2025-64329 vanusuri
2025-12-02  1:11   ` Bruce Ashfield
2025-12-02  2:48     ` Vijay Anusuri
2025-12-02  4:45       ` Bruce Ashfield
2025-11-19 23:28 ` [meta-virtualization][kirkstone][PATCH 1/2] containerd-opencontainers: fix CVE-2024-25621 Bruce Ashfield

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.