packages/crun
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix CVE-2022-27650

Browse Source
This commit is contained in:
fu-shanqing 2022-05-23 13:58:13 +08:00
parent f060e8f509
commit a7b8932e62
2 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
crun.spec
View File

@ -1,9 +1,10 @@
Name: crun Name: crun
Version: 1.4.3 Version: 1.4.3
Release: 1 Release: 2
Summary: A fast and low-memory footprint OCI Container Runtime fully written in C. Summary: A fast and low-memory footprint OCI Container Runtime fully written in C.
URL: https://github.com/containers/%{name} URL: https://github.com/containers/%{name}
Source0: https://github.com/containers/crun/releases/download/%{version}/%{name}-%{version}.tar.xz Source0: https://github.com/containers/crun/releases/download/%{version}/%{name}-%{version}.tar.xz
Patch0: fix-CVE-2022-27650.patch
License: GPLv2+ and LGPLv2.1+ License: GPLv2+ and LGPLv2.1+
BuildRequires: autoconf automake gcc python BuildRequires: autoconf automake gcc python
BuildRequires: libcap-devel systemd-devel yajl-devel libseccomp-devel libselinux-devel BuildRequires: libcap-devel systemd-devel yajl-devel libseccomp-devel libselinux-devel
@ -42,6 +43,9 @@ rm -rf %{buildroot}%{_prefix}/lib*
%{_mandir}/man1/* %{_mandir}/man1/*
%changelog %changelog
* Mon May 23 2022 fushanqing <fushanqing@kylinos.cn> - 1.4.3-2
- fix CVE-2022-27650.
* Tue Mar 1 2022 fu-shanqing <fushanqing@kylinos.cn> - 1.4.3-1 * Tue Mar 1 2022 fu-shanqing <fushanqing@kylinos.cn> - 1.4.3-1
- Update to 1.4.3 - Update to 1.4.3

14
fix-CVE-2022-27650.patch Normal file
View File

@ -0,0 +1,14 @@
diff -Naru crun-1.4.3/src/exec.c crun-1.4.3-new/src/exec.c
--- crun-1.4.3/src/exec.c 2021-11-05 14:53:28.000000000 +0800
+++ crun-1.4.3-new/src/exec.c 2022-05-23 13:51:13.000000000 +0800
@@ -304,8 +304,8 @@
capabilities->effective = exec_options.cap;
capabilities->effective_len = exec_options.cap_size;
- capabilities->inheritable = dup_array (exec_options.cap, exec_options.cap_size);
- capabilities->inheritable_len = exec_options.cap_size;
+ capabilities->inheritable = NULL;
+ capabilities->inheritable_len = 0;
capabilities->bounding = dup_array (exec_options.cap, exec_options.cap_size);
capabilities->bounding_len = exec_options.cap_size;