From b3ebda75a55e4d308f80f282983622839423faaa Mon Sep 17 00:00:00 2001 From: dongyuzhen Date: Fri, 24 Oct 2025 16:57:14 +0800 Subject: [PATCH] fix CVE-2020-27151 (cherry picked from commit c7f25bee3f9437c29c99333fb7d7433c75eaacff) --- kata-containers.spec | 8 ++++- runtime/patches/0099-fix-CVE-2020-27151.patch | 34 +++++++++++++++++++ runtime/series.conf | 1 + 3 files changed, 42 insertions(+), 1 deletion(-) create mode 100644 runtime/patches/0099-fix-CVE-2020-27151.patch diff --git a/kata-containers.spec b/kata-containers.spec index 1b6394b..9c52cc4 100644 --- a/kata-containers.spec +++ b/kata-containers.spec @@ -2,7 +2,7 @@ %global debug_package %{nil} %define VERSION 1.11.1 -%define RELEASE 27 +%define RELEASE 28 Name: kata-containers Version: %{VERSION} @@ -98,6 +98,12 @@ install -p -m 640 -D ./runtime/cli/config/configuration-qemu.toml %{buildroot}/u %doc %changelog +* Fri Oct 24 2025 dongyuzhen - 1.11.1-28 +- Type:CVE +- ID:NA +- SUG:NA +- DESC:fix CVE-2020-27151 + * Wed Oct 15 2025 dongyuzhen - 1.11.1-27 - Type:enhancement - ID:NA diff --git a/runtime/patches/0099-fix-CVE-2020-27151.patch b/runtime/patches/0099-fix-CVE-2020-27151.patch new file mode 100644 index 0000000..5abb930 --- /dev/null +++ b/runtime/patches/0099-fix-CVE-2020-27151.patch @@ -0,0 +1,34 @@ +From 0cba3754fca32e1135eadfacb6268af3dd4e3afc Mon Sep 17 00:00:00 2001 +From: dongyuzhen +Date: Fri, 24 Oct 2025 16:15:18 +0800 +Subject: [PATCH] fix CVE-2020-27151 + +--- + virtcontainers/pkg/oci/utils.go | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/virtcontainers/pkg/oci/utils.go b/virtcontainers/pkg/oci/utils.go +index 7305c65..0ecac68 100644 +--- a/virtcontainers/pkg/oci/utils.go ++++ b/virtcontainers/pkg/oci/utils.go +@@ -571,7 +571,7 @@ func addHypervisorMemoryOverrides(ocispec specs.Spec, sbConfig *vc.SandboxConfig + } + + if value, ok := ocispec.Annotations[vcAnnotations.FileBackedMemRootDir]; ok { +- sbConfig.HypervisorConfig.FileBackedMemRootDir = value ++ logrus.Warnf("the file_mem_backend annotation is not supported (value: %s)", value) + } + + if value, ok := ocispec.Annotations[vcAnnotations.HugePages]; ok { +@@ -706,7 +706,7 @@ func addHypervisporVirtioFsOverrides(ocispec specs.Spec, sbConfig *vc.SandboxCon + } + + if value, ok := ocispec.Annotations[vcAnnotations.VirtioFSDaemon]; ok { +- sbConfig.HypervisorConfig.VirtioFSDaemon = value ++ logrus.Warnf("the virtio_fs_daemon annotation is not supported (value: %s)", value) + } + + if sbConfig.HypervisorConfig.SharedFS == config.VirtioFS && sbConfig.HypervisorConfig.VirtioFSDaemon == "" { +-- +2.43.0 + diff --git a/runtime/series.conf b/runtime/series.conf index c54d65e..30c5a61 100644 --- a/runtime/series.conf +++ b/runtime/series.conf @@ -96,3 +96,4 @@ 0096-kata-containers-Move-from-query-cpus-to-query-cpus-f.patch 0097-kata-runtime-add-timeout-for-all-qmp-commands.patch 0098-kata-runtime-remove-kernel_irqchip-option.patch +0099-fix-CVE-2020-27151.patch -- Gitee