Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update openssl to 3.3.2 under cloud-hypervisor-cvm in order to address CVE-2024-6119 #10475

Open
wants to merge 1 commit into
base: fasttrack/3.0
Choose a base branch
from
+35 −7
Open

Update openssl to 3.3.2 under cloud-hypervisor-cvm in order to address CVE-2024-6119 #10475

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion SPECS/cloud-hypervisor-cvm/cloud-hypervisor-cvm.signatures.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"Signatures": {
"cloud-hypervisor-cvm-38.0.72.2-cargo.tar.gz": "12190a4f2fbd29b2c6c197388a958eab5dff91e8d75927841669d81d794eadf4",
"cloud-hypervisor-cvm-38.0.72.2-2-cargo.tar.gz": "68d1dc8f2a70fddad934e9131ccad7ce2c96323869433419e2f488062396bcc8",
"cloud-hypervisor-cvm-38.0.72.2.tar.gz": "1a357a0805f7b6d90993d5ae246c2dedff88cf98c9c0eab0903dc8071be0dae2",
"config.toml": "74c28b7520c157109b8990b325fe8f13504e56561a9bac51499d4c6bf4a66e52"
}
Expand Down
26 changes: 20 additions & 6 deletions SPECS/cloud-hypervisor-cvm/cloud-hypervisor-cvm.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
Name: cloud-hypervisor-cvm
Summary: Cloud Hypervisor CVM is an open source Virtual Machine Monitor (VMM) that enables running SEV SNP enabled VMs on top of MSHV using the IGVM file format as payload.
Version: 38.0.72.2
Release: 1%{?dist}
Release: 2%{?dist}
License: ASL 2.0 OR BSD-3-clause
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand All @@ -15,14 +15,22 @@ Source0: https://github.com/microsoft/cloud-hypervisor/archive/refs/tags/
%if 0%{?using_vendored_crates}
# Note: the %%{name}-%%{version}-cargo.tar.gz file contains a cache created by capturing the contents downloaded into $CARGO_HOME.
# To update the cache and config.toml run:
# tar -xf %{name}-%{version}.tar.gz
# cd %{name}-%{version}
# tar -xf %%{name}-%%{version}.tar.gz
# cd %%{name}-%%{version}
# patch -u -p0 < ../upgrade-openssl-to-3.3.2-to-address-CVE-2024-6119.patch
jiria marked this conversation as resolved.
Show resolved Hide resolved
# cargo vendor > config.toml
# tar -czf %{name}-%{version}-cargo.tar.gz vendor/
# rename the tarball to %{name}-%{version}-cargo.tar.gz when updating version
Source1: %{name}-%{version}-cargo.tar.gz
# tar -czf %%{name}-%%{version}-cargo.tar.gz vendor/
# rename the tarball to %%{name}-%%{version}-2-cargo.tar.gz when updating version
# (feel free to drop -2 and this comment on version change)
Source1: %{name}-%{version}-2-cargo.tar.gz
Source2: config.toml
%endif
# Generated using:
# tar -xf %%{name}-%%{version}.tar.gz
# cd %%{name}-%%{version}
# cargo update -p openssl-src --precise 300.3.2+3.3.2
# diff -u ../cloud-hypervisor-msft-v38.0.72.2.backup/Cargo.lock Cargo.lock > ../upgrade-openssl-to-3.3.2-to-address-CVE-2024-6119.patch
Patch0: upgrade-openssl-to-3.3.2-to-address-CVE-2024-6119.patch
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In theory we should be able to introduce openssh-devel and the rust build should use the system version of openssh and break the dependency on openssl. I think and I think that might be a better solution.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is that something that you want to do as part of high sev CVE as opposed to merging as is and addressing separately?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am ok taking it this way, but nobody will follow up on that until the next CVE issue. If my suggestion is correct, then it will be essentially fix this issue permanently...and I think that would be a better solution.


BuildRequires: binutils
BuildRequires: gcc
Expand Down Expand Up @@ -75,6 +83,9 @@ tar xf %{SOURCE1}
mkdir -p .cargo
cp %{SOURCE2} .cargo/
%endif
# The vendored archive has been populated based on the patch, so we need to
# repatch here as well in order to use the same versions
%autopatch -p0

%install
install -d %{buildroot}%{_bindir}
Expand Down Expand Up @@ -136,6 +147,9 @@ cargo build --release --target=%{rust_musl_target} %{cargo_pkg_feature_opts} %{c
%license LICENSE-BSD-3-Clause

%changelog
* Tue Sep 17 2024 Jiri Appl <[email protected]> - 38.0.72.2-2
- Patch openssl in the vendored archive to 3.3.2 to address CVE-2024-6119

* Fri Jul 12 2024 Archana Choudhary <[email protected]> - 38.0.72.2-1
- Upgrade to v38.0.72.2
- Fixes CVE-2023-45853, CVE-2018-25032, CVE-2023-5363, CVE-2023-5678, CVE-2023-6129, CVE-2023-6237, CVE-2024-0727, CVE-2024-4603
Expand Down
14 changes: 14 additions & 0 deletions SPECS/cloud-hypervisor-cvm/upgrade-openssl-to-3.3.2-to-address-CVE-2024-6119.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
--- ../cloud-hypervisor-msft-v38.0.72.2.backup/Cargo.lock 2024-09-17 12:55:41.269905595 -0700
+++ Cargo.lock 2024-09-17 13:49:15.579003678 -0700
@@ -1421,9 +1421,9 @@

[[package]]
name = "openssl-src"
-version = "300.3.1+3.3.1"
+version = "300.3.2+3.3.2"
PawelWMS marked this conversation as resolved.
Show resolved Hide resolved
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7259953d42a81bf137fbbd73bd30a8e1914d6dce43c2b90ed575783a22608b91"
+checksum = "a211a18d945ef7e648cc6e0058f4c548ee46aab922ea203e0d30e966ea23647b"
dependencies = [
"cc",
]
Loading