[sync] PR-320: fix CVE-2026-46680-containerd-AtomGit

已合并

[sync] PR-320: fix CVE-2026-46680 #322

openeuler-ci-bot创建于 5 天前从sync-pr320-openEuler-24.03-LTS-Next-to-openEuler-24.03-LTS-SP3 合入到 openEuler-24.03-LTS-SP3

[sync] PR-320: fix CVE-2026-46680 #322

已合并

openeuler-ci-bot创建于 5 天前

从sync-pr320-openEuler-24.03-LTS-Next-to-openEuler-24.03-LTS-SP3合入到openEuler-24.03-LTS-SP3

共 4 个文件变更+117-2

Mcontainerd.spec+7-1

	@@ -2,7 +2,7 @@
2	%global debug_package %{nil}	2	%global debug_package %{nil}
3	Version: 1.6.22	3	Version: 1.6.22
4	Name: containerd	4	Name: containerd
5	-Release: 30	5	+Release: 31
6	Summary: An industry-standard container runtime	6	Summary: An industry-standard container runtime
7	License: ASL 2.0	7	License: ASL 2.0
8	URL: https://containerd.io	8	URL: https://containerd.io
	@@ -68,6 +68,12 @@ install -D -p -m 0644 %{S:7} %{buildroot}%{_sysconfdir}/containerd/config.toml
68	%exclude %{_bindir}/containerd-stress	68	%exclude %{_bindir}/containerd-stress
69		69
70	%changelog	70	%changelog
		71	+* Thu Aug 27 2026 jade_t <yzd50036@gmail.com> - 1.6.22-31
		72	+- Type:CVE
		73	+- ID:NA
		74	+- SUG:NA
		75	+- DESC:fix CVE-2026-46680
		76	+
71	* Wed Aug 12 2026 jade_t <yzd50036@gmail.com> - 1.6.22-30	77	* Wed Aug 12 2026 jade_t <yzd50036@gmail.com> - 1.6.22-30
72	- Type:CVE	78	- Type:CVE
73	- ID:NA	79	- ID:NA

Mgit-commit+1-1

	@@ -1 +1 @@
1	-f26473869b1be97d5a59d04e65e8002e4fae64d6	1	+2daaa6e32cc25797da578ad721978d4f79c3f20a

Apatch/0054-containerd-fix-CVE-2026-46680.patch+108-0

@@ -0,0 +1,108 @@
	1	+From 503f479466b432bd16fd9f14e10b6d4b09812730 Mon Sep 17 00:00:00 2001
	2	+From: LEI WANG <ssst0n3@gmail.com>
	3	+Date: Tue, 17 Mar 2026 17:58:00 +0800
	4	+Subject: [PATCH] oci: return explicit error for out-of-range USER values
	5	+
	6	+Detect strconv.ErrRange and validate uid/gid bounds to avoid falling back to username/group lookups.
	7	+
	8	+Signed-off-by: LEI WANG <ssst0n3@gmail.com>
	9	+(cherry picked from commit 85706b6d4416d93b47033ba345d7b885a75657b4)
	10	+Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
	11	+---
	12	+ oci/spec_opts.go \| 29 +++++++++++++++++++++++++----
	13	+ oci/spec_opts_linux_test.go \| 14 +++++++++++---
	14	+ 2 files changed, 36 insertions(+), 7 deletions(-)
	15	+
	16	+diff --git a/oci/spec_opts.go b/oci/spec_opts.go
	17	+index f54c629..6713757 100644
	18	+--- a/oci/spec_opts.go
	19	++++ b/oci/spec_opts.go
	20	+@@ -610,14 +610,25 @@ func WithUser(userstr string) SpecOpts {
	21	+ return nil
	22	+ }
	23	+
	24	++ isErrRange := func(err error) bool {
	25	++ var numErr *strconv.NumError
	26	++ return errors.As(err, &numErr) && numErr.Err == strconv.ErrRange
	27	++ }
	28	++
	29	+ parts := strings.Split(userstr, ":")
	30	+ switch len(parts) {
	31	+ case 1:
	32	+ v, err := strconv.Atoi(parts[0])
	33	+- if err != nil \|\| v < minUserID \|\| v > maxUserID {
	34	+- // if we cannot parse as an int32 then try to see if it is a username
	35	++ if err != nil {
	36	++ if isErrRange(err) {
	37	++ return fmt.Errorf("invalid USER value %q: uid out of range", userstr)
	38	++ }
	39	++ // Non-numeric user value; treat it as a username.
	40	+ return WithUsername(userstr)(ctx, client, c, s)
	41	+ }
	42	++ if v < minUserID \|\| v > maxUserID {
	43	++ return fmt.Errorf("invalid USER value %q: uid out of range", userstr)
	44	++ }
	45	+ return WithUserID(uint32(v))(ctx, client, c, s)
	46	+ case 2:
	47	+ var (
	48	+@@ -626,14 +637,24 @@ func WithUser(userstr string) SpecOpts {
	49	+ )
	50	+ var uid, gid uint32
	51	+ v, err := strconv.Atoi(parts[0])
	52	+- if err != nil \|\| v < minUserID \|\| v > maxUserID {
	53	++ if err != nil {
	54	++ if isErrRange(err) {
	55	++ return fmt.Errorf("invalid USER value %q: uid out of range", userstr)
	56	++ }
	57	+ username = parts[0]
	58	++ } else if v < minUserID \|\| v > maxUserID {
	59	++ return fmt.Errorf("invalid USER value %q: uid out of range", userstr)
	60	+ } else {
	61	+ uid = uint32(v)
	62	+ }
	63	+ v, err = strconv.Atoi(parts[1])
	64	+- if err != nil \|\| v < minGroupID \|\| v > maxGroupID {
	65	++ if err != nil {
	66	++ if isErrRange(err) {
	67	++ return fmt.Errorf("invalid USER value %q: gid out of range", userstr)
	68	++ }
	69	+ groupname = parts[1]
	70	++ } else if v < minGroupID \|\| v > maxGroupID {
	71	++ return fmt.Errorf("invalid USER value %q: gid out of range", userstr)
	72	+ } else {
	73	+ gid = uint32(v)
	74	+ }
	75	+diff --git a/oci/spec_opts_linux_test.go b/oci/spec_opts_linux_test.go
	76	+index fd77d22..5020a49 100644
	77	+--- a/oci/spec_opts_linux_test.go
	78	++++ b/oci/spec_opts_linux_test.go
	79	+@@ -91,15 +91,23 @@ guest:x:100:guest
	80	+ },
	81	+ {
	82	+ user: "405:2147483648",
	83	+- err: "no groups found",
	84	++ err: "invalid USER value \"405:2147483648\": gid out of range",
	85	+ },
	86	+ {
	87	+ user: "-1000",
	88	+- err: "no users found",
	89	++ err: "invalid USER value \"-1000\": uid out of range",
	90	+ },
	91	+ {
	92	+ user: "2147483648",
	93	+- err: "no users found",
	94	++ err: "invalid USER value \"2147483648\": uid out of range",
	95	++ },
	96	++ {
	97	++ user: "999999999999999999999999999999999999",
	98	++ err: "invalid USER value \"999999999999999999999999999999999999\": uid out of range",
	99	++ },
	100	++ {
	101	++ user: "0:999999999999999999999999999999999999",
	102	++ err: "invalid USER value \"0:999999999999999999999999999999999999\": gid out of range",
	103	+ },
	104	+ }
	105	+ for _, testCase := range testCases {
	106	+--
	107	+2.54.0
	108	+

Mseries.conf+1-0

	@@ -50,3 +50,4 @@ patch/0050-containerd-fix-possible-panic-from-WithMediaTypeKeyPref.patch
50	patch/0051-containerd-fix-CVE-2026-47262.patch	50	patch/0051-containerd-fix-CVE-2026-47262.patch
51	patch/0052-containerd-fix-CVE-2026-53488.patch	51	patch/0052-containerd-fix-CVE-2026-53488.patch
52	patch/0053-containerd-fix-CVE-2026-35469.patch	52	patch/0053-containerd-fix-CVE-2026-35469.patch
		53	+patch/0054-containerd-fix-CVE-2026-46680.patch