Skip to content

[release-1.27] Bump runc up to 1.2.9 for CVE-2025-52881, CVE-2025-31133 and CVE-2025-52565 #6540

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Draft
wants to merge 23 commits into
base: release-1.27
Choose a base branch
from
Draft

[release-1.27] Bump runc up to 1.2.9 for CVE-2025-52881, CVE-2025-31133 and CVE-2025-52565 #6540

wants to merge 23 commits into from

Conversation

@cevich
Copy link
Member

@cevich cevich commented Nov 26, 2025 •
edited
Loading

What type of PR is this?

/kind other

What this PR does / why we need it:

Backport PR #6484 & #6511

How to verify it

CI + Manual

Which issue(s) this PR fixes:

None

Special notes for your reviewer:

The commits in this PR were created with the assistance of AI, from #6538. When reviewing please pay special attention to the following:

  1. Vendor directory consistency:

    • Vendor directory was completely regenerated using make vendor-in-container after each go.mod change
    • Never manually edited, ensuring consistency with go.mod and go.sum
    • Backport change: Same process as source branch - vendor directory was regenerated after dependency updates to ensure consistency.

  2. All compilation verified:

    • Project compiles successfully with make after every commit
    • All compilation errors encountered during backport were resolved and ammended to the commit.

  3. "Disable lint checking"

    • This check fails on the branch even w/o any changes.
    • In CI the problem is difficult to diagnose as no output is provided,
      rather the process is simply killed.
    • Backport change: This commit was manually created, it does not exist on the
      source PRs.

  4. "Bump runc to v1.2.8 - CVE-2025-52881" includes the lockfile API fix:

    • internal/parse/parse.go: Replaced lockfile.Locked() check with defer/recover pattern around lockfile.Unlock()
    • run_common.go: Same lockfile API fix applied
    • Reason: New lockfile API panics if unlocking an unlocked lock; the old Locked() method no longer exists

  5. Handle Cobra v1.5 -> v1.8 behavior changes

    • Restore previous CLI behavior (Cobra 1.5) to match documentation.
    • --userns-uid-map and --userns-gid-map flags:
      • Left visible on the root command (buildah --help) to match docs/buildah.1.md
      • Hidden as local flags on build and from subcommands to prevent duplication
    • --debug and -d flags:
      • Hidden as local flags on the info command
    • --compat-auth-file flag:
      • Hidden as local flags on login and logout commands

  6. "Add a dummy 'runtime' that just dumps its config file" applies PTY changes correctly:

    • Changes applied to chroot/run_linux.go (not chroot/run_common.go which doesn't exist in release-1.27)
    • Added import: "github.com/containers/buildah/internal/pty"
    • Replaced inline PTY code (lines 250-282) with: ptyMasterFd, ptyFd, err := pty.GetPtyDescriptors()
    • Removed unused unsafe import
    • Fixed type conversion: os.NewFile(uintptr(ptyFd), "/dev/tty") (converted int to uintptr)

  7. Version bump is 1.27.7:

    • Created using buildah_release 1.27.7 script.
    • Updated define/types.go, CHANGELOG.md, and changelog.txt

Does this PR introduce a user-facing change?

None

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Nov 26, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: cevich
Once this PR has been reviewed and has the lgtm label, please assign tomsweeneyredhat for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@cevich cevich marked this pull request as draft November 26, 2025 16:02
@cevich
Disable lint checking
659d09f 
Sometime prior to this commit, changes were made on this branch which
broke linting.  This was apparently ignored.  Disabling the check to
permit CI to continue without it.

Signed-off-by: Chris Evich <[email protected]>
@cevich
Bump minimum to golang 1.22.6
1556e70 
This change is required for future commits that will bring in newer
vendored modules with elevated requirements.

Signed-off-by: Chris Evich <[email protected]>
Assisted-by: Claude (Anthropic)
(cherry picked from commit bc3f298)
@cevich
Bump CI environment to match release-1.39
ac17cd7 
In CI, the project and tests are compiled, so therefore require newer
CI/VM images with support for the newer golang requirements.

Signed-off-by: Chris Evich <[email protected]>
Assisted-by: Claude (Anthropic)
(cherry picked from commit c6cdb98)
@cevich cevich force-pushed the release-1.27_cve_3113-52565-52881 branch from 118ff7a to 80cf9ef Compare November 26, 2025 19:22
@cevich
Copy link
Member Author

cevich commented Nov 26, 2025 •
edited
Loading

I'm loosing my 🧠 here with ./hack/xref-helpmsgs-manpages failures in the Smoke Test. I've been backward and forward through the backported changes and don't see any that obviously add CLI options. So they must be coming from someplace else? What am I missing (and sorry if it should be obvious, my 🧠 is really sore at this point)?

Edit: My clanker has identified the root cause as a Cobra v1.8 update + behavior change. Code-updates are needed to fix this.

@cevich cevich mentioned this pull request Nov 26, 2025
Draft
@cevich cevich force-pushed the release-1.27_cve_3113-52565-52881 branch 5 times, most recently from 266d702 to 7e83a65 Compare December 2, 2025 13:38
TomSweeneyRedHat and others added 15 commits December 2, 2025 11:31
@TomSweeneyRedHat @cevich
Bump x/tools to v0.26.0
4daf443 
Bumping golang.org/x/tools to v0.26.0 per @nalind's
suggestion.

Signed-off-by: tomsweeneyredhat <[email protected]>
Signed-off-by: Chris Evich <[email protected]>
@cevich
Proxy module access
8d09064 
Signed-off-by: Chris Evich <[email protected]>
Assisted-by: Claude (Anthropic)
(cherry picked from commit d7d8754)
@cevich
util.SortMounts(): make the returned order more stable
22e82ce 
Use sort.Stable() instead of sort.Sort() to sort mounts, and have the
comparison function compare the cleaned paths directly if they have the
same number of components, so that there's a defined ordering between
"/a" and "/b".

Signed-off-by: Chris Evich <[email protected]>
Assisted-by: Claude (Anthropic)
Signed-off-by: Chris Evich <[email protected]>
@TomSweeneyRedHat @cevich
Bump runc to v1.2.9
13590bf 
This addresses bumping crun to v1.2.9, which is a huge jump
but is necessary to address CVE-2025-52881, CVE-2025-31133
and CVE-2025-52565 plus various regressions in earlier versions.

Fixes: https://issues.redhat.com/browse/RHEL-126919

Signed-off-by: Chris Evich <[email protected]>
@cevich
Handle Cobra v1.5 -> v1.8 behavior changes
bf7b960 
A prior commit brought in a newer Cobra (out of necessity) which also
hauled in behavior changes WRT global-vs-local flag handling.  In order
to preserve the `buildah` CLI options prior to this change, additional
code changes are needed.  Fix the code such that
`hack/xref-helpmsgs-manpages` does not report any differences compared
to the pre-existing documentation (which presumably passed the check).

Signed-off-by: Chris Evich <[email protected]>
Assisted-by: Claude (Anthropic)
@cevich
vendor: switch to moby/sys/capability
6202c7f 
github.com/moby/sys/capability is a fork of the (no longer maintained)
github.com/syndtr/gocapability package.

For the list of changes since the fork took place, see
https://github.com/moby/sys/blob/main/capability/CHANGELOG.md

Signed-off-by: Kir Kolyshkin <[email protected]>

Signed-off-by: Chris Evich <[email protected]>
Assisted-by: Claude (Anthropic)
@nalind @cevich
finish switching to moby/sys/capability
fa028ce 
Signed-off-by: Nalin Dahyabhai <[email protected]>
@cevich
Don't set ambient capabilities
f39f0ca 
Ambient capabilities can't be raised without inheritable ones, and since we
don't raise inheritable, we should not raise ambient either.

This went unnoticed because of a bug in syndtr/gocapability which is
only fixed in its fork (see the next commit).

Amends commit e7e55c9.

Signed-off-by: Kir Kolyshkin <[email protected]>

Signed-off-by: Chris Evich <[email protected]>
Assisted-by: Claude (Anthropic)
@cevich
Integration tests: run git daemon on a random-but-bind()able port
ed808c2 
Use a listener helper to bind to an available-according-to-the-kernel
listening port and run a command with its stdio more or less tied to the
connection instead of trying to launch a git daemon directly using a
port number that we can only guess is available.

Signed-off-by: Nalin Dahyabhai <[email protected]>

Signed-off-by: Chris Evich <[email protected]>
Assisted-by: Claude (Anthropic)
@cevich
run: handle relabeling bind mounts ourselves
ce792b6 
Handle requested relabeling of bind mounts (i.e., the "z" and "Z" flags)
directly, instead of letting the runtime handle the relabeling.

Signed-off-by: Nalin Dahyabhai <[email protected]>

Signed-off-by: Chris Evich <[email protected]>
Assisted-by: Claude (Anthropic)
@cevich
Add a dummy "runtime" that just dumps its config file
46e9a0e 
Signed-off-by: Nalin Dahyabhai <[email protected]>

Signed-off-by: Chris Evich <[email protected]>
Assisted-by: Claude (Anthropic)
@cevich
runUsingRuntime: use named constants for runtime states
97dca44 
Use the named constants for the status values that runtimes can report
to us when we run them with the "state" command.

Signed-off-by: Nalin Dahyabhai <[email protected]>

Signed-off-by: Chris Evich <[email protected]>
Assisted-by: Claude (Anthropic)
@cevich
buildah-build(1): clarify that --cgroup-parent affects RUN instructions
d894aa5 
Tweak the wording that describes the effects of --cgroup-parent to be
clear that it only affects handling of RUN instructions.

Signed-off-by: Nalin Dahyabhai <[email protected]>

Signed-off-by: Chris Evich <[email protected]>
Assisted-by: Claude (Anthropic)
@cevich
CI: run integration tests on Fedora with both crun and runc
ea70804 
Run integration tests (both as root and rootless) with both crun and
runc on Fedora, to help ensure that we can use either.

Signed-off-by: Nalin Dahyabhai <[email protected]>

Signed-off-by: Chris Evich <[email protected]>
Assisted-by: Claude (Anthropic)
@cevich
Adjust tests for new CI environment
cfb372b 
The previous handful of commits introduced fairly massive changes to
buildah, including an overhaul of the CI runtime environment itself.
Because of this, several tests need adjusting to match the new reality.

Signed-off-by: Chris Evich <[email protected]>
cevich added 5 commits December 2, 2025 11:31
@cevich
Prune CI tests for RHEL release branch
e1de70c 
This branch is only used as the source for RHEL releases, prune CI tests
that are irrelevant for this purpose.

Signed-off-by: Chris Evich <[email protected]>
Assisted-by: Claude (Anthropic)
@cevich
Skip bud with --cpu-shares test on runc/cgroupsv2
23d71b6 
A bug is present in some versions of runc (including 1.2.8) which result
in the wrong number of CPU shares being used.  Since the runc version
may change in a future commit, but still contain the bug, simply skip
the test rather than checking against the miscalculated value.

Signed-off-by: Chris Evich <[email protected]>
Assisted-by: Claude (Anthropic)
@cevich
Adjust supportability date to match RHEL 8.6
704c67a 
Signed-off-by: Chris Evich <[email protected]>
@cevich
Remove -cover flag from test-unit target
37dc686 
The -cover flag causes many 'error: coverage... ; no coverage data written'
messages when GOCOVERDIR is not set. These messages needlessly clutter the test output.  Remove the -cover flag.

Signed-off-by: Chris Evich <[email protected]>
Assisted-by: Claude (Anthropic)
@cevich
Bump Buildah to v1.27.7
acfc699 
Signed-off-by: Chris Evich <[email protected]>
@cevich cevich force-pushed the release-1.27_cve_3113-52565-52881 branch from 7e83a65 to acfc699 Compare December 2, 2025 16:31
@cevich
Copy link
Member Author

cevich commented Dec 2, 2025

Backported:

Note: I saw a few commits (6bf7400 and 56eadec) I may consider bringing here in place of disabling the lint-checking, but it's a low priority ATM.

@cevich cevich mentioned this pull request Dec 4, 2025
Open
@dashea dashea mentioned this pull request Dec 4, 2025
Closed
@cevich cevich changed the title [release-1.27] Bump runc up to 1.2.8 for CVE-2025-52881, CVE-2025-31133 and CVE-2025-52565 [release-1.27] Bump runc up to 1.2.9 for CVE-2025-52881, CVE-2025-31133 and CVE-2025-52565 Dec 4, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

do-not-merge/work-in-progress kind/other

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@cevich @TomSweeneyRedHat @nalind