Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: bump versionize from 0.1.10 to 0.2.0 and rust version #7

Merged
merged 1 commit into from
Jan 22, 2025

Conversation

BraveY
Copy link

@BraveY BraveY commented Jan 22, 2025

To fix this dragonflyoss/nydus#1647, we need bump versionize here first.
Cargo-deny(v0.16.4) checks of fuse-backend-rs also reports an error as follows:

error[unsound]: `serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory access
   ┌─ /home/bravey/community/fuse-backend-rs/Cargo.lock:73:1
   │
73 │ vmm-sys-util 0.11.2 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
   │
   ├ ID: RUSTSEC-2024-0002
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2024-0002
   ├ ## Impact
     
     An issue was discovered in the `FamStructWrapper::deserialize` implementation
     provided by the crate for `vmm_sys_util::fam::FamStructWrapper`, which can lead
     to out of bounds memory accesses. The deserialization does not check that the
     length stored in the header matches the flexible array length. Mismatch in the
     lengths might allow out of bounds memory access through Rust-safe methods.
     
     Impacted versions: >= 0.5.0
     
     ## Patches
     
     The issue was corrected in version 0.12.0 by inserting a check that verifies
     the lengths of compared flexible arrays are equal for any deserialized header
     and aborting deserialization otherwise. Moreover, the API was changed so that
     header length can only be modified through Rust-unsafe code. This ensures that
     users cannot trigger out-of-bounds memory access from Rust-safe code.
   ├ Announcement: https://github.com/advisories/GHSA-875g-mfp6-g7f9
   ├ Solution: Upgrade to >=0.12.0 (try `cargo update -p vmm-sys-util`)
   ├ vmm-sys-util v0.11.2
     └── versionize v0.1.10
         └── dbs-snapshot v1.5.1
             └── fuse-backend-rs v0.12.0

Follow the RUSTSEC-2024-0002 advisory, bump versionize.

Signed-off-by: Yang Kaiyong <[email protected]>
Copy link

@imeoer imeoer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@imeoer imeoer merged commit b5b28d4 into kata-containers:main Jan 22, 2025
19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants