Skip to content

Commit b1c6ca2

Browse files
azurelinux-securityazurelinux-security
authored
[AutoPR- Security] Patch kubevirt for CVE-2026-7374 [CRITICAL] (microsoft#17586)
1 parent c616ed6 commit b1c6ca2

2 files changed

Lines changed: 185 additions & 1 deletion

File tree

‎SPECS/kubevirt/CVE-2026-7374.patch‎

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
From 0b495d25ad05cb724f94908e8f4d7a84d58ca41c Mon Sep 17 00:00:00 2001
2+
From: Jed Lejosne <jed@redhat.com>
3+
Date: Tue, 21 Apr 2026 16:09:50 -0400
4+
Subject: [PATCH 1/2] Use safepath for virt-launcher console socket paths
5+
6+
The console handler was directly constructing paths to virt-launcher
7+
sockets (virt-serial0, virt-vnc, virt-usbredir) through /proc/<pid>/root
8+
without safepath protection, making it vulnerable to symlink attacks.
9+
10+
Switch getUnixSocketPath to use res.MountRoot() with safepath's
11+
AppendAndResolveWithRelativeRoot, and perform net.Dial inside
12+
ExecuteNoFollow so the connection uses a kernel-managed fd path. Also
13+
use /run instead of /var/run since the latter is a symlink.
14+
15+
Assisted-by: Claude (Anthropic AI assistant)
16+
Made-with: Cursor
17+
Signed-off-by: Jed Lejosne <jed@redhat.com>
18+
(cherry picked from commit aa2b64ecdc784743901a728f52bd76fd213054de)
19+
Signed-off-by: Jed Lejosne <jed@redhat.com>
20+
---
21+
pkg/virt-handler/rest/BUILD.bazel | 1 +
22+
pkg/virt-handler/rest/console.go | 42 ++++++++++++++++---------------
23+
2 files changed, 23 insertions(+), 20 deletions(-)
24+
25+
diff --git a/pkg/virt-handler/rest/BUILD.bazel b/pkg/virt-handler/rest/BUILD.bazel
26+
index 8d14d89..7ef7998 100644
27+
--- a/pkg/virt-handler/rest/BUILD.bazel
28+
+++ b/pkg/virt-handler/rest/BUILD.bazel
29+
@@ -11,6 +11,7 @@ go_library(
30+
importpath = "kubevirt.io/kubevirt/pkg/virt-handler/rest",
31+
visibility = ["//visibility:public"],
32+
deps = [
33+
+ "//pkg/safepath:go_default_library",
34+
"//pkg/util:go_default_library",
35+
"//pkg/virt-handler/cmd-client:go_default_library",
36+
"//pkg/virt-handler/isolation:go_default_library",
37+
diff --git a/pkg/virt-handler/rest/console.go b/pkg/virt-handler/rest/console.go
38+
index bcad432..9a853da 100644
39+
--- a/pkg/virt-handler/rest/console.go
40+
+++ b/pkg/virt-handler/rest/console.go
41+
@@ -26,8 +26,6 @@ import (
42+
"io"
43+
"net"
44+
"net/http"
45+
- "os"
46+
- "path"
47+
"strconv"
48+
"sync"
49+
50+
@@ -41,6 +39,7 @@ import (
51+
kvcorev1 "kubevirt.io/client-go/kubevirt/typed/core/v1"
52+
"kubevirt.io/client-go/log"
53+
54+
+ "kubevirt.io/kubevirt/pkg/safepath"
55+
"kubevirt.io/kubevirt/pkg/util"
56+
"kubevirt.io/kubevirt/pkg/virt-handler/isolation"
57+
)
58+
@@ -86,7 +85,7 @@ func (t *ConsoleHandler) USBRedirHandler(request *restful.Request, response *res
59+
uid := vmi.GetUID()
60+
stopChan := make(chan struct{})
61+
var slotId int
62+
- var unixSocketPath string
63+
+ var unixSocketPath *safepath.Path
64+
ok := func() bool {
65+
// For simplicity, we handle one usbredir request at the time, for all VMIs
66+
// handled by virt-handler
67+
@@ -287,30 +286,33 @@ func deleteStopChan(uid types.UID, stopChn chan struct{}, lock *sync.Mutex, stop
68+
}
69+
}
70+
71+
-func (t *ConsoleHandler) getUnixSocketPath(vmi *v1.VirtualMachineInstance, socketName string) (string, error) {
72+
+func (t *ConsoleHandler) getUnixSocketPath(vmi *v1.VirtualMachineInstance, socketName string) (*safepath.Path, error) {
73+
result, err := t.podIsolationDetector.Detect(vmi)
74+
if err != nil {
75+
- return "", err
76+
+ return nil, err
77+
}
78+
- socketDir := path.Join("/proc", strconv.Itoa(result.Pid()), "root", "var", "run", "kubevirt-private", string(vmi.GetUID()))
79+
- socketPath := path.Join(socketDir, socketName)
80+
- if _, err = os.Stat(socketPath); errors.Is(err, os.ErrNotExist) {
81+
- return "", err
82+
+ root, err := result.MountRoot()
83+
+ if err != nil {
84+
+ return nil, err
85+
}
86+
-
87+
- return socketPath, nil
88+
+ return root.AppendAndResolveWithRelativeRoot("run", "kubevirt-private", string(vmi.GetUID()), socketName)
89+
}
90+
91+
-func unixSocketDialer(vmi *v1.VirtualMachineInstance, unixSocketPath string) func() (net.Conn, error) {
92+
+func unixSocketDialer(vmi *v1.VirtualMachineInstance, socketPath *safepath.Path) func() (net.Conn, error) {
93+
return func() (net.Conn, error) {
94+
- log.Log.Object(vmi).Infof("Connecting to %s", unixSocketPath)
95+
- fd, err := net.Dial("unix", unixSocketPath)
96+
- if err != nil {
97+
- log.Log.Object(vmi).Reason(err).Errorf("failed to dial unix socket %s", unixSocketPath)
98+
- return nil, err
99+
- }
100+
- log.Log.Object(vmi).Infof("Connected to %s", unixSocketPath)
101+
- return fd, nil
102+
+ var conn net.Conn
103+
+ err := socketPath.ExecuteNoFollow(func(safePath string) error {
104+
+ log.Log.Object(vmi).Infof("Connecting to %s", safePath)
105+
+ var dialErr error
106+
+ conn, dialErr = net.Dial("unix", safePath)
107+
+ if dialErr != nil {
108+
+ log.Log.Object(vmi).Reason(dialErr).Errorf("failed to dial unix socket %s", safePath)
109+
+ return dialErr
110+
+ }
111+
+ log.Log.Object(vmi).Infof("Connected to %s", safePath)
112+
+ return nil
113+
+ })
114+
+ return conn, err
115+
}
116+
}
117+
118+
--
119+
2.45.4
120+
121+
122+
From 596d34ecda8e1db2b10b61a8a29d093889d3b203 Mon Sep 17 00:00:00 2001
123+
From: Jed Lejosne <jed@redhat.com>
124+
Date: Tue, 21 Apr 2026 16:12:23 -0400
125+
Subject: [PATCH 2/2] Add unit tests for console handler safepath usage
126+
127+
Test getUnixSocketPath and unixSocketDialer to verify:
128+
- socket paths are resolved via MountRoot + safepath
129+
- paths containing symlinks are rejected
130+
- missing sockets and isolation errors are handled
131+
- dialer connects through ExecuteNoFollow
132+
133+
Assisted-by: Claude (Anthropic AI assistant)
134+
Made-with: Cursor
135+
Signed-off-by: Jed Lejosne <jed@redhat.com>
136+
(cherry picked from commit fdce2270a11e3e1b38d6b7aac4239ce185c7ac64)
137+
Signed-off-by: Jed Lejosne <jed@redhat.com>
138+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
139+
Upstream-reference: https://github.com/kubevirt/kubevirt/pull/17920.patch
140+
---
141+
pkg/virt-handler/rest/BUILD.bazel | 22 +++++++++++++++++++++-
142+
1 file changed, 21 insertions(+), 1 deletion(-)
143+
144+
diff --git a/pkg/virt-handler/rest/BUILD.bazel b/pkg/virt-handler/rest/BUILD.bazel
145+
index 7ef7998..d7206b5 100644
146+
--- a/pkg/virt-handler/rest/BUILD.bazel
147+
+++ b/pkg/virt-handler/rest/BUILD.bazel
148+
@@ -1,4 +1,4 @@
149+
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
150+
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
151+
152+
go_library(
153+
name = "go_default_library",
154+
@@ -28,3 +28,23 @@ go_library(
155+
"//vendor/k8s.io/client-go/util/certificate:go_default_library",
156+
],
157+
)
158+
+
159+
+go_test(
160+
+ name = "go_default_test",
161+
+ srcs = [
162+
+ "console_test.go",
163+
+ "rest_suite_test.go",
164+
+ ],
165+
+ embed = [":go_default_library"],
166+
+ race = "on",
167+
+ deps = [
168+
+ "//pkg/safepath:go_default_library",
169+
+ "//pkg/unsafepath:go_default_library",
170+
+ "//pkg/virt-handler/isolation:go_default_library",
171+
+ "//staging/src/kubevirt.io/client-go/api:go_default_library",
172+
+ "//staging/src/kubevirt.io/client-go/testutils:go_default_library",
173+
+ "//vendor/github.com/onsi/ginkgo/v2:go_default_library",
174+
+ "//vendor/github.com/onsi/gomega:go_default_library",
175+
+ "//vendor/go.uber.org/mock/gomock:go_default_library",
176+
+ ],
177+
+)
178+
--
179+
2.45.4
180+

‎SPECS/kubevirt/kubevirt.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
Summary: Container native virtualization
2121
Name: kubevirt
2222
Version: 1.7.1
23-
Release: 5%{?dist}
23+
Release: 6%{?dist}
2424
License: ASL 2.0
2525
Vendor: Microsoft Corporation
2626
Distribution: Azure Linux
@@ -42,6 +42,7 @@ Patch11: CVE-2026-39827.patch
4242
Patch12: CVE-2026-39828.patch
4343
Patch13: CVE-2026-39835.patch
4444
Patch14: CVE-2026-42502.patch
45+
Patch15: CVE-2026-7374.patch
4546

4647
%global debug_package %{nil}
4748
BuildRequires: swtpm-tools
@@ -279,6 +280,9 @@ install -p -m 0644 cmd/virt-launcher/qemu.conf %{buildroot}%{_datadir}/kube-virt
279280
%{_bindir}/virt-tests
280281

281282
%changelog
283+
* Mon Jun 01 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.7.1-6
284+
- Patch for CVE-2026-7374
285+
282286
* Wed May 27 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.7.1-5
283287
- Patch for CVE-2026-46597, CVE-2026-42506, CVE-2026-39829, CVE-2026-39834, CVE-2026-39830, CVE-2026-39821, CVE-2026-27136, CVE-2026-42502, CVE-2026-39835, CVE-2026-39828, CVE-2026-39827, CVE-2026-25681, CVE-2026-25680
284288

0 commit comments

Comments
 (0)