chore(deps): update module golang.org/x/sys to v0.44.0 [security]#2729
chore(deps): update module golang.org/x/sys to v0.44.0 [security]#2729redhat-renovate-bot wants to merge 1 commit into
Conversation
Signed-off-by: redhat-renovate-bot <redhat-internal-renovate@redhat.com>
redhat-renovate-bot
added
the
release-note-none
kubevirt-bot
added
the
dco-signoff: yes
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the golang.org/x/sys dependency to v0.44.0 and introduces several enhancements, including Windows ARM64 CPU feature detection and a new CPUSetDynamic type for Linux to support CPU affinity masks larger than 1024 bits. It also adds various Windows networking syscalls and improves Utime handling across several Linux architectures. Review feedback identified a critical bug in SetMemPolicyDynamic where the mask size is incorrectly passed in bytes rather than bits, and recommended adding input validation to NewCPUSet to prevent potential panics from negative input values.
| func SetMemPolicyDynamic(mode int, mask CPUSetDynamic) error { | ||
| return setMemPolicy(mode, mask.pointer(), mask.size()) | ||
| } |
There was a problem hiding this comment.
The set_mempolicy syscall expects the number of bits (maxnode) as its third argument, but mask.size() returns the size in bytes. This will cause the kernel to only consider a fraction of the intended nodes (e.g., only the first 128 nodes if 1024 were intended on a 64-bit system). It should be updated to pass the number of bits.
| func SetMemPolicyDynamic(mode int, mask CPUSetDynamic) error { | |
| return setMemPolicy(mode, mask.pointer(), mask.size()) | |
| } | |
| func SetMemPolicyDynamic(mode int, mask CPUSetDynamic) error { | |
| return setMemPolicy(mode, mask.pointer(), uintptr(len(mask))*_NCPUBITS) | |
| } |
| func NewCPUSet(maxCPU int) CPUSetDynamic { | ||
| numMasks := (maxCPU + _NCPUBITS - 1) / _NCPUBITS | ||
| if numMasks == 0 { | ||
| numMasks = 1 | ||
| } | ||
| return make(CPUSetDynamic, numMasks) | ||
| } |
There was a problem hiding this comment.
The NewCPUSet function does not validate that maxCPU is non-negative. If a large negative value is passed (e.g., less than -63 when _NCPUBITS is 64), the numMasks calculation can result in a negative integer, leading to a panic when make is called. Adding a check for negative input would make the function more robust.
func NewCPUSet(maxCPU int) CPUSetDynamic {
if maxCPU < 0 {
maxCPU = 0
}
numMasks := (maxCPU + _NCPUBITS - 1) / _NCPUBITS
if numMasks == 0 {
numMasks = 1
}
return make(CPUSetDynamic, numMasks)
}2 participants
This PR contains the following updates:
v0.43.0→v0.44.0Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
CVE-2026-39824 / GO-2026-5024
More information
Details
NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.