Skip to content

Commit de4ba7a

Browse files
azurelinux-securityKanishk-Bansalakhila-guruju
authored
[AutoPR- Security] Patch containerd2 for CVE-2026-42502, CVE-2026-25681, CVE-2026-25680 [MEDIUM] (microsoft#17574)
Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com> Co-authored-by: Akhila Guruju <v-guakhila@microsoft.com>
1 parent 1a956b6 commit de4ba7a

4 files changed

Lines changed: 292 additions & 4 deletions

File tree

‎SPECS/containerd2/CVE-2026-25680.patch‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
From d827d288a2b268271239d07306a45f495894461d Mon Sep 17 00:00:00 2001
2+
From: Roland Shoemaker <roland@golang.org>
3+
Date: Tue, 12 May 2026 15:36:39 -0400
4+
Subject: [PATCH] html: improve Noah's Ark clause performance
5+
6+
Instead of iterating over each element in the stack, and checking each
7+
attribute against each other attribute in a ~cubic fashion, sort the
8+
attributes and just use slices.Equal.
9+
10+
Thanks to IPC Labs for reporting this issue.
11+
12+
Fixes CVE-2026-25680
13+
14+
Change-Id: Iec3513ba0b5da4f28f1359d24846401b9ab76ee3
15+
Reviewed-on: https://go-review.googlesource.com/c/net/+/781702
16+
TryBot-Bypass: Roland Shoemaker <roland@golang.org>
17+
Reviewed-by: Nicholas Husin <nsh@golang.org>
18+
Reviewed-by: Neal Patel <nealpatel@google.com>
19+
Reviewed-by: Nicholas Husin <husin@google.com>
20+
Auto-Submit: Gopher Robot <gobot@golang.org>
21+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
22+
Upstream-reference: https://github.com/golang/net/commit/08be507abce89191d78cd49da60f4501fc910472.patch
23+
---
24+
vendor/golang.org/x/net/html/parse.go | 34 ++++++++++++++++-----------
25+
1 file changed, 20 insertions(+), 14 deletions(-)
26+
27+
diff --git a/vendor/golang.org/x/net/html/parse.go b/vendor/golang.org/x/net/html/parse.go
28+
index 70a6335..b3d2a25 100644
29+
--- a/vendor/golang.org/x/net/html/parse.go
30+
+++ b/vendor/golang.org/x/net/html/parse.go
31+
@@ -5,9 +5,11 @@
32+
package html
33+
34+
import (
35+
+ "cmp"
36+
"errors"
37+
"fmt"
38+
"io"
39+
+ "slices"
40+
"strings"
41+
42+
a "golang.org/x/net/html/atom"
43+
@@ -328,6 +330,14 @@ func (p *parser) addText(text string) {
44+
})
45+
}
46+
47+
+func attrCompare(a, b Attribute) int {
48+
+ return cmp.Or(
49+
+ cmp.Compare(a.Namespace, b.Namespace),
50+
+ cmp.Compare(a.Key, b.Key),
51+
+ cmp.Compare(a.Val, b.Val),
52+
+ )
53+
+}
54+
+
55+
// addElement adds a child element based on the current token.
56+
func (p *parser) addElement() {
57+
p.addChild(&Node{
58+
@@ -343,6 +353,10 @@ func (p *parser) addFormattingElement() {
59+
tagAtom, attr := p.tok.DataAtom, p.tok.Attr
60+
p.addElement()
61+
62+
+ // In order to optimize the search, we need the attributes to be sorted, so we
63+
+ // can just use slices.Equal.
64+
+ slices.SortFunc(attr, attrCompare)
65+
+
66+
// Implement the Noah's Ark clause, but with three per family instead of two.
67+
identicalElements := 0
68+
findIdenticalElements:
69+
@@ -360,19 +374,7 @@ findIdenticalElements:
70+
if n.DataAtom != tagAtom {
71+
continue
72+
}
73+
- if len(n.Attr) != len(attr) {
74+
- continue
75+
- }
76+
- compareAttributes:
77+
- for _, t0 := range n.Attr {
78+
- for _, t1 := range attr {
79+
- if t0.Key == t1.Key && t0.Namespace == t1.Namespace && t0.Val == t1.Val {
80+
- // Found a match for this attribute, continue with the next attribute.
81+
- continue compareAttributes
82+
- }
83+
- }
84+
- // If we get here, there is no attribute that matches a.
85+
- // Therefore the element is not identical to the new one.
86+
+ if !slices.Equal(n.Attr, attr) {
87+
continue findIdenticalElements
88+
}
89+
90+
@@ -382,7 +384,11 @@ findIdenticalElements:
91+
}
92+
}
93+
94+
- p.afe = append(p.afe, p.top())
95+
+ // Sort the attributes to optimize future identical-element searches.
96+
+ top := p.top()
97+
+ slices.SortFunc(top.Attr, attrCompare)
98+
+
99+
+ p.afe = append(p.afe, top)
100+
}
101+
102+
// Section 12.2.4.3.
103+
--
104+
2.45.4
105+

‎SPECS/containerd2/CVE-2026-25681.patch‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
From 8877ca93a7bdbf7868c0a2cb941042b74fe2983f Mon Sep 17 00:00:00 2001
2+
From: Roland Shoemaker <roland@golang.org>
3+
Date: Mon, 4 May 2026 11:47:15 -0700
4+
Subject: [PATCH] html: escape greater-than symbol in doctype identifiers
5+
6+
During parsing, we unescape character references. When rendering, we
7+
re-escape certain characters in certain scenarios in order to avoid
8+
token content causing unexpected parser behavior.
9+
10+
We appear to have not taken this into account when rendering DOCTYPE
11+
tokens, allowing ">" in PUBLIC/SYSTEM identifier strings, which trigger
12+
a abrupt-doctype-system-identifier parse error which immediately emits
13+
the current DOCTYPE token and then continues parsing in the data state.
14+
15+
This may cause bypass in HTML santizers which use the html package for
16+
parsing.
17+
18+
Thanks to ensy for reporting this issue.
19+
20+
Fixes CVE-2026-25681
21+
22+
Change-Id: I1d5be92129d17bfbf0917148db2672d57c224a18
23+
Reviewed-on: https://go-review.googlesource.com/c/net/+/781703
24+
Reviewed-by: Neal Patel <nealpatel@google.com>
25+
Reviewed-by: Nicholas Husin <nsh@golang.org>
26+
TryBot-Bypass: Roland Shoemaker <roland@golang.org>
27+
Auto-Submit: Gopher Robot <gobot@golang.org>
28+
Reviewed-by: Nicholas Husin <husin@google.com>
29+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
30+
Upstream-reference: https://github.com/golang/net/commit/4ece7b612ad44ad6c4d5e0d5d4df9c18cc211905.patch
31+
---
32+
vendor/golang.org/x/net/html/render.go | 19 +++++++++++++------
33+
.../html/testdata/go/doctype_named_entity.dat | 8 ++++++++
34+
2 files changed, 21 insertions(+), 6 deletions(-)
35+
create mode 100644 vendor/golang.org/x/net/html/testdata/go/doctype_named_entity.dat
36+
37+
diff --git a/vendor/golang.org/x/net/html/render.go b/vendor/golang.org/x/net/html/render.go
38+
index 0157d89..671fcdb 100644
39+
--- a/vendor/golang.org/x/net/html/render.go
40+
+++ b/vendor/golang.org/x/net/html/render.go
41+
@@ -113,14 +113,14 @@ func render1(w writer, n *Node) error {
42+
if _, err := w.WriteString(" PUBLIC "); err != nil {
43+
return err
44+
}
45+
- if err := writeQuoted(w, p); err != nil {
46+
+ if err := writeDoctypeQuoted(w, p); err != nil {
47+
return err
48+
}
49+
if s != "" {
50+
if err := w.WriteByte(' '); err != nil {
51+
return err
52+
}
53+
- if err := writeQuoted(w, s); err != nil {
54+
+ if err := writeDoctypeQuoted(w, s); err != nil {
55+
return err
56+
}
57+
}
58+
@@ -128,7 +128,7 @@ func render1(w writer, n *Node) error {
59+
if _, err := w.WriteString(" SYSTEM "); err != nil {
60+
return err
61+
}
62+
- if err := writeQuoted(w, s); err != nil {
63+
+ if err := writeDoctypeQuoted(w, s); err != nil {
64+
return err
65+
}
66+
}
67+
@@ -251,19 +251,26 @@ func childTextNodesAreLiteral(n *Node) bool {
68+
}
69+
}
70+
71+
-// writeQuoted writes s to w surrounded by quotes. Normally it will use double
72+
+// writeDoctypeQuoted writes s to w surrounded by quotes. Normally it will use double
73+
// quotes, but if s contains a double quote, it will use single quotes.
74+
+// If s contains any '>' characters, they are replaced with &gt; in order
75+
+// to prevent triggering an abrupt-doctype-system-identifier parse error.
76+
// It is used for writing the identifiers in a doctype declaration.
77+
// In valid HTML, they can't contain both types of quotes.
78+
-func writeQuoted(w writer, s string) error {
79+
+func writeDoctypeQuoted(w writer, s string) error {
80+
var q byte = '"'
81+
if strings.Contains(s, `"`) {
82+
+ // parseDoctype will never produce a Node with both quote types, but a user
83+
+ // can construct their own Node that violates this assumption.
84+
+ if strings.Contains(s, `'`) {
85+
+ return errors.New("doctype contains both quote types, cannot be safely rendered")
86+
+ }
87+
q = '\''
88+
}
89+
if err := w.WriteByte(q); err != nil {
90+
return err
91+
}
92+
- if _, err := w.WriteString(s); err != nil {
93+
+ if _, err := w.WriteString(strings.ReplaceAll(s, ">", "&gt;")); err != nil {
94+
return err
95+
}
96+
if err := w.WriteByte(q); err != nil {
97+
diff --git a/vendor/golang.org/x/net/html/testdata/go/doctype_named_entity.dat b/vendor/golang.org/x/net/html/testdata/go/doctype_named_entity.dat
98+
new file mode 100644
99+
index 0000000..a8bd963
100+
--- /dev/null
101+
+++ b/vendor/golang.org/x/net/html/testdata/go/doctype_named_entity.dat
102+
@@ -0,0 +1,8 @@
103+
+#data
104+
+<!DOCTYPE &gt; PUBLIC "&gt;" "&gt;">
105+
+#errors
106+
+#document
107+
+| <!DOCTYPE > ">" ">">
108+
+| <html>
109+
+| <head>
110+
+| <body>
111+
--
112+
2.45.4
113+

‎SPECS/containerd2/CVE-2026-42502.patch‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
From c04dfca58f9fce1a305d66a9b7cf414ab08bd825 Mon Sep 17 00:00:00 2001
2+
From: Roland Shoemaker <roland@golang.org>
3+
Date: Mon, 4 May 2026 14:01:10 -0700
4+
Subject: [PATCH] html: properly render fostered elements in foreign content
5+
6+
When we foster elements under another parent, there are complicated
7+
rules about which namespace may apply. This in particular affects
8+
childTextNodesAreLiteral, which checks if we should be emitting raw
9+
text, or escaped text.
10+
11+
In childTextNodesAreLiteral, check if there is an ancestor which has a
12+
different namespace. If one is found, check if it's an HTML integration
13+
point. If not, treat the node as if it were in its parents namespace, if
14+
so, treat it as HTML.
15+
16+
Thanks to Tristan Madani for reporting this issue.
17+
18+
Fixes CVE-2026-42502
19+
20+
Change-Id: I0ae1780dae335e5f719d7f176cefa83670cfea3d
21+
Reviewed-on: https://go-review.googlesource.com/c/net/+/781701
22+
Reviewed-by: Neal Patel <nealpatel@google.com>
23+
Reviewed-by: Nicholas Husin <nsh@golang.org>
24+
TryBot-Bypass: Roland Shoemaker <roland@golang.org>
25+
Reviewed-by: Nicholas Husin <husin@google.com>
26+
Auto-Submit: Gopher Robot <gobot@golang.org>
27+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
28+
Upstream-reference: https://github.com/golang/net/commit/a8fb2fe4f7378f816302b9f2f7b8290ce512e5dd.patch
29+
---
30+
vendor/golang.org/x/net/html/render.go | 16 ++++++++++++++++
31+
1 file changed, 16 insertions(+)
32+
33+
diff --git a/vendor/golang.org/x/net/html/render.go b/vendor/golang.org/x/net/html/render.go
34+
index 671fcdb..767eeae 100644
35+
--- a/vendor/golang.org/x/net/html/render.go
36+
+++ b/vendor/golang.org/x/net/html/render.go
37+
@@ -243,8 +243,24 @@ func childTextNodesAreLiteral(n *Node) bool {
38+
if n.Namespace != "" {
39+
return false
40+
}
41+
+
42+
switch n.Data {
43+
case "iframe", "noembed", "noframes", "noscript", "plaintext", "script", "style", "xmp":
44+
+ // We need to check if n is a node that was fostered from a HTML namespace
45+
+ // into a non-HTML namespace (in which case, different rules apply to it).
46+
+ // We do this by walking up the tree until we find a node with a non-empty
47+
+ // namespace. If we find such a node, we also have to check if it's
48+
+ // an HTML integration point. If it isn't, then the node we're currently
49+
+ // looking at is foster-parented and we should return false.
50+
+ for p := n.Parent; p != nil; p = p.Parent {
51+
+ if p.Namespace != "" {
52+
+ if !htmlIntegrationPoint(p) {
53+
+ return false
54+
+ }
55+
+ break
56+
+ }
57+
+ }
58+
+
59+
return true
60+
default:
61+
return false
62+
--
63+
2.45.4
64+

‎SPECS/containerd2/containerd2.spec‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
Summary: Industry-standard container runtime
66
Name: %{upstream_name}2
77
Version: 2.2.4
8-
Release: 2%{?dist}
8+
Release: 3%{?dist}
99
License: ASL 2.0
1010
Group: Tools/Container
1111
URL: https://www.containerd.io
@@ -24,6 +24,9 @@ Patch4: fix-TestCgroupNamespace-cgroupv1.patch
2424
Patch5: CVE-2026-39821.patch
2525
Patch6: CVE-2026-42506.patch
2626
Patch7: CVE-2026-27136.patch
27+
Patch8: CVE-2026-25680.patch
28+
Patch9: CVE-2026-25681.patch
29+
Patch10: CVE-2026-42502.patch
2730

2831
%{?systemd_requires}
2932

@@ -100,10 +103,13 @@ fi
100103
%dir /opt/containerd/lib
101104

102105
%changelog
106+
* Mon Jun 01 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.2.4-3
107+
- Patch for CVE-2026-42502, CVE-2026-25681, CVE-2026-25680
108+
103109
* Sat May 30 2026 Jon Slobodzian <joslobo@microsoft.com> - 2.2.4-2
104110
- Resolve merge from fasttrack, bring patches for CVE-2026-42506, CVE-2026-39821, CVE-2026-27136 forward to 2.2.4 version of containerd2.
105111

106-
* Thu May 28 2026 Aadhar Agarwal <aadagarwal@microsoft.com> - 2.2.4-1
112+
* Fri May 29 2026 Aadhar Agarwal <aadagarwal@microsoft.com> - 2.2.4-1
107113
- Upgrade to 2.2.4
108114
- Pulls in CVE-2026-46680 fix (PR #13448 / 0a8f65bef)
109115
- Remove CVE-2026-34986.patch (in v2.2.4: go-jose/v4 v4.1.4, PR #13292 / 4413816ce)
@@ -114,10 +120,10 @@ fi
114120
- Add fix-TestCgroupNamespace-cgroupv1.patch (PR #13240; allows %check on cgroup-v1 build hosts)
115121
- Regenerate multi-snapshotters-support.patch against v2.2.4 (upstream absorbed runtimeHandler plumbing in v2.2.3)
116122

117-
* Wed May 28 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.1.6-5
123+
* Fri May 29 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.1.6-5
118124
- Patch for CVE-2026-33814
119125

120-
* Mon May 28 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.1.6-4
126+
* Thu May 28 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.1.6-4
121127
- Patch for CVE-2026-39882
122128

123129
* Wed May 27 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.1.6-3

0 commit comments

Comments
 (0)