Skip to content

Commit 28a2586

Browse files
anphel31anphel31
authored
Merge pull request #5829 from microsoft/sammeluch/1.0-release
Mariner 1.0 July Update
2 parents f39d7be + 97b7811 commit 28a2586

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

49 files changed

+503
-487
lines changed

Diff for: ‎SPECS-SIGNED/kernel-signed/kernel-signed.spec

+4-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
%define uname_r %{version}-%{release}
1010
Summary: Signed Linux Kernel for %{buildarch} systems
1111
Name: kernel-signed-%{buildarch}
12-
Version: 5.10.183.1
12+
Version: 5.10.185.1
1313
Release: 1%{?dist}
1414
License: GPLv2
1515
Vendor: Microsoft Corporation
@@ -147,6 +147,9 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg
147147
%endif
148148

149149
%changelog
150+
* Wed Jun 28 2023 CBL-Mariner Servicing Account <[email protected]> - 5.10.185.1-1
151+
- Auto-upgrade to 5.10.185.1
152+
150153
* Tue Jun 13 2023 CBL-Mariner Servicing Account <[email protected]> - 5.10.183.1-1
151154
- Auto-upgrade to 5.10.183.1
152155

Diff for: ‎SPECS/apr/CVE-2022-28331.nopatch

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
CVE reference https://nvd.nist.gov/vuln/detail/CVE-2022-28331. Only affects windows version, therefore not CBL-Mariner.

Diff for: ‎SPECS/apr/apr.spec

+24-7
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,34 @@
11
Summary: The Apache Portable Runtime
22
Name: apr
33
Version: 1.6.5
4-
Release: 5%{?dist}
4+
Release: 6%{?dist}
55
License: ASL 2.0
6-
URL: https://apr.apache.org/
7-
Group: System Environment/Libraries
86
Vendor: Microsoft Corporation
97
Distribution: Mariner
8+
Group: System Environment/Libraries
9+
URL: https://apr.apache.org/
1010
Source0: http://archive.apache.org/dist/%{name}/%{name}-%{version}.tar.gz
1111
%define aprver 1
12-
1312
%if %{with_check}
1413
# test_serv_by_name test requires /etc/services file from iana-etc package
1514
BuildRequires: iana-etc
1615
%endif
1716

1817
%description
1918
The Apache Portable Runtime.
19+
2020
%package devel
2121
Summary: Header and development files
2222
Requires: %{name} = %{version}-%{release}
23+
2324
%description devel
2425
It contains the libraries and header files to create applications
2526

2627
%prep
27-
%setup -q
28+
%autosetup -p1
29+
2830
%build
29-
./configure --prefix=/usr \
31+
./configure --prefix=%{_prefix} \
3032
--includedir=%{_includedir}/apr-%{aprver} \
3133
--with-installbuilddir=%{_libdir}/apr/build-%{aprver} \
3234
--with-devrandom=/dev/urandom \
@@ -52,7 +54,7 @@ make -j1 check
5254
%exclude %{_libdir}/pkgconfig
5355
%{_bindir}/*
5456

55-
%files devel
57+
%files devel
5658
%defattr(-,root,root)
5759
%{_includedir}/*
5860
%{_libdir}/*.la
@@ -61,29 +63,44 @@ make -j1 check
6163
%{_libdir}/pkgconfig
6264

6365
%changelog
66+
* Mon Jul 03 2023 Mykhailo Bykhovtsev <[email protected]> - 1.6.5-6
67+
- Nopatch CVE-2022-28331 as it affects only Windows.
68+
- Switch to use autosetup.
69+
6470
* Thu Oct 28 2021 Pawel Winogrodzki <[email protected]> - 1.6.5-5
6571
- Fixing tests further by making them run on a single thread.
6672
- Removed `%%sha1` macro.
6773
- License verified.
74+
6875
* Mon Dec 07 2020 Andrew Phelps <[email protected]> - 1.6.5-4
6976
- Fix check tests.
77+
7078
* Sat May 09 2020 Nick Samson <[email protected]> - 1.6.5-3
7179
- Added %%license line automatically
80+
7281
* Tue Sep 03 2019 Mateusz Malisz <[email protected]> - 1.6.5-2
7382
- Initial CBL-Mariner import from Photon (license: Apache2).
83+
7484
* Tue Sep 18 2018 Ankit Jain <[email protected]> - 1.6.5-1
7585
- Updated to version 1.6.5
86+
7687
* Fri Dec 08 2017 Xiaolin Li <[email protected]> - 1.5.2-7
7788
- Fix CVE-2017-12613
89+
7890
* Tue May 24 2016 Priyesh Padmavilasom <[email protected]> - 1.5.2-6
7991
- GA - Bump release of all rpms
92+
8093
* Mon Sep 21 2015 Harish Udaiya Kumar <[email protected]> - 1.5.2-5
8194
- Repacked to move the include files in devel package.
95+
8296
* Wed Jul 15 2015 Sarah Choi <[email protected]> - 1.5.2-4
8397
- Use aprver(=1) instead of version for mesos
98+
8499
* Mon Jul 13 2015 Alexey Makhalov <[email protected]> - 1.5.2-3
85100
- Exclude /usr/lib/debug
101+
86102
* Wed Jul 01 2015 Touseef Liaqat <[email protected]> - 1.5.2-2
87103
- Fix tags and paths.
104+
88105
* Wed May 20 2015 Touseef Liaqat <[email protected]> - 1.5.2-1
89106
- Initial build. First version

Diff for: ‎SPECS/cloud-hypervisor/CVE-2023-0465.patch

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
The CVE-2023-2650.patch also fixes CVE-2023-0465

Diff for: ‎SPECS/cloud-hypervisor/CVE-2023-2650.patch

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
From 724eeff414725dd8b6be8429f3acd316b92f7a56 Mon Sep 17 00:00:00 2001
2+
From: Suresh Thelkar <[email protected]>
3+
Date: Fri, 30 Jun 2023 09:49:24 +0530
4+
Subject: [PATCH] Patch for CVE-2023-2650 and CVE-2023-0465
5+
6+
---
7+
Cargo.lock | 8 ++++----
8+
1 file changed, 4 insertions(+), 4 deletions(-)
9+
10+
diff --git a/Cargo.lock b/Cargo.lock
11+
index f99b516..99af0b2 100644
12+
--- a/Cargo.lock
13+
+++ b/Cargo.lock
14+
@@ -119,9 +119,9 @@ checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
15+
16+
[[package]]
17+
name = "cc"
18+
-version = "1.0.73"
19+
+version = "1.0.79"
20+
source = "registry+https://github.com/rust-lang/crates.io-index"
21+
-checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11"
22+
+checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
23+
24+
[[package]]
25+
name = "cfg-if"
26+
@@ -574,9 +574,9 @@ dependencies = [
27+
28+
[[package]]
29+
name = "openssl-src"
30+
-version = "111.17.0+1.1.1m"
31+
+version = "111.26.0+1.1.1u"
32+
source = "registry+https://github.com/rust-lang/crates.io-index"
33+
-checksum = "05d6a336abd10814198f66e2a91ccd7336611f30334119ca8ce300536666fcf4"
34+
+checksum = "efc62c9f12b22b8f5208c23a7200a442b2e5999f8bdf80233852122b5a4f6f37"
35+
dependencies = [
36+
"cc",
37+
]
38+
--
39+
2.38.1
40+

Diff for: ‎SPECS/cloud-hypervisor/cloud-hypervisor.signatures.json

+4-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
{
22
"Signatures": {
3-
"cloud-hypervisor-22.0-cargo.tar.gz": "550e2e2ad6c64ae7fa4786582c2357993cfad1f205566f6c80bcef7888cbd702",
4-
"cloud-hypervisor-22.0.tar.gz": "5c5440435f78d4acdbb3ea91abe17d6704da6c18b6f52fe77f15835cfc60d17a"
3+
"cloud-hypervisor-22.0-cargo-3.cm1.tar.gz": "c54238aa053bfcba7b507982a1e8583bd6885dddf261e1a908977dcc84434214",
4+
"cloud-hypervisor-22.0.tar.gz": "5c5440435f78d4acdbb3ea91abe17d6704da6c18b6f52fe77f15835cfc60d17a",
5+
"cloud-hypervisor-22.0-vendor-3.cm1.tar.gz": "61721dce31d7a5c5c55347ecef6f0752d0d28a1b48f5e03b8e4cbb07b2eb2e6a"
56
}
6-
}
7+
}

Diff for: ‎SPECS/cloud-hypervisor/cloud-hypervisor.spec

+13-10
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,19 @@
11
Summary: A Rust-VMM based cloud hypervisor from Intel
22
Name: cloud-hypervisor
33
Version: 22.0
4-
Release: 2%{?dist}
4+
Release: 3%{?dist}
55
License: ASL 2.0 or BSD
66
URL: https://github.com/cloud-hypervisor/cloud-hypervisor
77
Group: Development/Tools
88
Vendor: Microsoft Corporation
99
Distribution: Mariner
10-
Source0: %{url}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
11-
# Note: the %%{name}-%%{version}-cargo.tar.gz file contains a cache created by capturing the contents downloaded into $CARGO_HOME.
12-
# To update the cache run:
13-
# [repo_root]/toolkit/scripts/build_cargo_cache.sh %%{name}-%%{version}.tar.gz
14-
Source1: %{name}-%{version}-cargo.tar.gz
10+
Source0: %{url}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
11+
# Note: the %%{name}-%%{version}-cargo-%%{release}.tar.gz file contains a cache created by capturing the contents downloaded into $CARGO_HOME.
12+
Source1: %{name}-%{version}-cargo-%{release}.tar.gz
13+
# Note: the %%{name}-%%{version}-vendor-%%{release}.tar.gz file contains vendor sources by capturing the contents downloaded into "vendor" folder when "cargo vendor" is run.
14+
Source2: %{name}-%{version}-vendor-%{release}.tar.gz
1515
Patch0: CVE-2023-28448.patch
16+
Patch1: CVE-2023-2650.patch
1617
ExclusiveArch: x86_64
1718

1819
BuildRequires: gcc
@@ -26,15 +27,14 @@ A Rust-VMM based cloud hypervisor from Intel.
2627

2728
%prep
2829
# Setup .cargo directory
29-
mkdir -p $HOME
30-
pushd $HOME
3130
tar xf %{SOURCE1} --no-same-owner
3231
%patch0 -p1
33-
popd
3432
%setup -q
33+
%patch1 -p1
34+
tar xf %{SOURCE2} -C ../ --no-same-owner
3535

3636
%build
37-
cargo build --release
37+
CARGO_HOME=$(pwd)/../.cargo cargo build --release --offline
3838

3939
%install
4040
install -d %{buildroot}%{_bindir}
@@ -51,6 +51,9 @@ install -d %{buildroot}%{_libdir}/cloud-hypervisor
5151
%exclude %{_libdir}/debug
5252

5353
%changelog
54+
* Tue Jul 04 2023 Suresh Thelkar <[email protected]> - 22.0-3
55+
- Patch CVE-2023-0465 and CVE-2023-2650
56+
5457
* Wed Apr 05 2023 Henry Beberman <[email protected]> - 22.0-2
5558
- Patch CVE-2023-28448 in vendored versionize crate
5659

Diff for: ‎SPECS/hyperv-daemons/hyperv-daemons.signatures.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,6 @@
77
"hypervkvpd.service": "25339871302f7a47e1aecfa9fc2586c78bc37edb98773752f0a5dec30f0ed3a1",
88
"hypervvss.rules": "94cead44245ef6553ab79c0bbac8419e3ff4b241f01bcec66e6f508098cbedd1",
99
"hypervvssd.service": "22270d9f0f23af4ea7905f19c1d5d5495e40c1f782cbb87a99f8aec5a011078d",
10-
"kernel-5.10.183.1.tar.gz": "1c48f2fc668c57ffb99560e63d05af5ed9c04aa3c63b3aef0a35099e28e97125"
10+
"kernel-5.10.185.1.tar.gz": "a86d1c424f6126ba3f55544703533a1b718bf955c817291887e4e67bbe965f71"
1111
}
1212
}

Diff for: ‎SPECS/hyperv-daemons/hyperv-daemons.spec

+4-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
%global udev_prefix 70
99
Summary: Hyper-V daemons suite
1010
Name: hyperv-daemons
11-
Version: 5.10.183.1
11+
Version: 5.10.185.1
1212
Release: 1%{?dist}
1313
License: GPLv2+
1414
Vendor: Microsoft Corporation
@@ -221,6 +221,9 @@ fi
221221
%{_sbindir}/lsvmbus
222222

223223
%changelog
224+
* Wed Jun 28 2023 CBL-Mariner Servicing Account <[email protected]> - 5.10.185.1-1
225+
- Auto-upgrade to 5.10.185.1
226+
224227
* Tue Jun 13 2023 CBL-Mariner Servicing Account <[email protected]> - 5.10.183.1-1
225228
- Auto-upgrade to 5.10.183.1
226229

Diff for: ‎SPECS/kernel-headers/kernel-headers.signatures.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
22
"Signatures": {
3-
"kernel-5.10.183.1.tar.gz": "1c48f2fc668c57ffb99560e63d05af5ed9c04aa3c63b3aef0a35099e28e97125"
3+
"kernel-5.10.185.1.tar.gz": "a86d1c424f6126ba3f55544703533a1b718bf955c817291887e4e67bbe965f71"
44
}
55
}

Diff for: ‎SPECS/kernel-headers/kernel-headers.spec

+4-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Summary: Linux API header files
22
Name: kernel-headers
3-
Version: 5.10.183.1
3+
Version: 5.10.185.1
44
Release: 1%{?dist}
55
License: GPLv2
66
Vendor: Microsoft Corporation
@@ -36,6 +36,9 @@ cp -rv usr/include/* /%{buildroot}%{_includedir}
3636
%{_includedir}/*
3737

3838
%changelog
39+
* Wed Jun 28 2023 CBL-Mariner Servicing Account <[email protected]> - 5.10.185.1-1
40+
- Auto-upgrade to 5.10.185.1
41+
3942
* Tue Jun 13 2023 CBL-Mariner Servicing Account <[email protected]> - 5.10.183.1-1
4043
- Auto-upgrade to 5.10.183.1
4144

Diff for: ‎SPECS/kernel-hyperv/config

+1-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#
22
# Automatically generated file; DO NOT EDIT.
3-
# Linux/x86_64 5.10.183.1 Kernel Configuration
3+
# Linux/x86_64 5.10.185.1 Kernel Configuration
44
#
55
CONFIG_CC_VERSION_TEXT="gcc (GCC) 9.1.0"
66
CONFIG_CC_IS_GCC=y
@@ -1369,7 +1369,6 @@ CONFIG_HAVE_NET_DSA=y
13691369
CONFIG_VLAN_8021Q=m
13701370
CONFIG_VLAN_8021Q_GVRP=y
13711371
CONFIG_VLAN_8021Q_MVRP=y
1372-
# CONFIG_DECNET is not set
13731372
CONFIG_LLC=m
13741373
# CONFIG_LLC2 is not set
13751374
# CONFIG_ATALK is not set
@@ -1671,7 +1670,6 @@ CONFIG_BLK_DEV_LOOP_MIN_COUNT=8
16711670
# CONFIG_BLK_DEV_DRBD is not set
16721671
# CONFIG_BLK_DEV_NBD is not set
16731672
# CONFIG_BLK_DEV_SKD is not set
1674-
# CONFIG_BLK_DEV_SX8 is not set
16751673
CONFIG_BLK_DEV_RAM=y
16761674
CONFIG_BLK_DEV_RAM_COUNT=16
16771675
CONFIG_BLK_DEV_RAM_SIZE=4096

Diff for: ‎SPECS/kernel-hyperv/kernel-hyperv.signatures.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
{
22
"Signatures": {
33
"cbl-mariner-ca-20211013.pem": "5ef124b0924cb1047c111a0ecff1ae11e6ad7cac8d1d9b40f98f99334121f0b0",
4-
"config": "3387855f3a5d67d9640385ca53da09a56d6f82c42ef1917d85185572e42bb6f5",
4+
"config": "a6fcad6cf7f6fe88ca2fdfe1e108ddd3fb1c4c6ed3fb55190b76a5f1ff936e3a",
55
"sha512hmac-openssl.sh": "02ab91329c4be09ee66d759e4d23ac875037c3b56e5a598e32fd1206da06a27f",
6-
"kernel-5.10.183.1.tar.gz": "1c48f2fc668c57ffb99560e63d05af5ed9c04aa3c63b3aef0a35099e28e97125"
6+
"kernel-5.10.185.1.tar.gz": "a86d1c424f6126ba3f55544703533a1b718bf955c817291887e4e67bbe965f71"
77
}
88
}

Diff for: ‎SPECS/kernel-hyperv/kernel-hyperv.spec

+4-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
%define uname_r %{version}-%{release}
44
Summary: Linux Kernel optimized for Hyper-V
55
Name: kernel-hyperv
6-
Version: 5.10.183.1
6+
Version: 5.10.185.1
77
Release: 1%{?dist}
88
License: GPLv2
99
Vendor: Microsoft Corporation
@@ -270,6 +270,9 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg
270270
%{_libdir}/perf/include/bpf/*
271271

272272
%changelog
273+
* Wed Jun 28 2023 CBL-Mariner Servicing Account <[email protected]> - 5.10.185.1-1
274+
- Auto-upgrade to 5.10.185.1
275+
273276
* Tue Jun 13 2023 CBL-Mariner Servicing Account <[email protected]> - 5.10.183.1-1
274277
- Auto-upgrade to 5.10.183.1
275278

Diff for: ‎SPECS/kernel/CVE-2023-3090.nopatch

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
CVE-2023-3090 - patched in 5.10.181.1 - (generated by autopatch tool)
2+
upstream 90cbed5247439a966b645b34eb0a2e037836ea8e - stable f4a371d3f5a7a71dff1ab48b3122c5cf23cc7ad5
3+

Diff for: ‎SPECS/kernel/CVE-2023-3212.nopatch

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
CVE-2023-3212 - patched in 5.10.183.1 - (generated by autopatch tool)
2+
upstream 504a10d9e46bc37b23d0a1ae2f28973c8516e636 - stable d03d31d3a206093b9b8759dddf0ba9bd843606ba
3+

Diff for: ‎SPECS/kernel/CVE-2023-3220.nopatch

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
CVE-2023-3220 - patched in 5.10.173.1 - (generated by autopatch tool)
2+
upstream 93340e10b9c5fc86730d149636e0aa8b47bb5a34 - stable e9743b3052e125c44b555f07f2876a4bdccfd983
3+

Diff for: ‎SPECS/kernel/CVE-2023-3355.nopatch

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
CVE-2023-3355 - Introducing commit(s) not present in LTS - (generated by autopatch tool)
2+
upstream fix commit: d839f0811a31322c087a859c2b181e2383daa7be
3+
upstream introducing commit: 20224d715a882210428ea62bba93f1bc4a0afe23
4+

Diff for: ‎SPECS/kernel/CVE-2023-3357.nopatch

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
CVE-2023-3357 - Introducing commit(s) not present in LTS - (generated by autopatch tool)
2+
upstream fix commit: 53ffa6a9f83b2170c60591da1ead8791d5a42e81
3+
upstream introducing commit: 4b2c53d93a4bc9d52cc0ec354629cfc9dc217f93
4+

Diff for: ‎SPECS/kernel/CVE-2023-3358.nopatch

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
CVE-2023-3358 - patched in 5.10.166.1 - (generated by autopatch tool)
2+
upstream b3d40c3ec3dc4ad78017de6c3a38979f57aaaab8 - stable 7b4516ba56f1fcb13ffc91912f3074e28362228d
3+

Diff for: ‎SPECS/kernel/CVE-2023-3359.nopatch

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
CVE-2023-3359 - Introducing commit(s) not present in LTS - (generated by autopatch tool)
2+
upstream fix commit: b0576ade3aaf24b376ea1a4406ae138e2a22b0c0
3+
upstream introducing commit: 6e977eaa8280e957b87904b536661550f2a6b3e8
4+

Diff for: ‎SPECS/kernel/CVE-2023-3439.nopatch

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
CVE-2023-3439 - Introducing commit(s) not present in LTS - (generated by autopatch tool)
2+
upstream fix commit: b561275d633bcd8e0e8055ab86f1a13df75a0269
3+
upstream introducing commit: 583be982d93479ea3d85091b0fd0b01201ede87d
4+

Diff for: ‎SPECS/kernel/CVE-2023-35788.nopatch

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
CVE-2023-35788 - patched in 5.10.183.1 - (generated by autopatch tool)
2+
upstream 4d56304e5827c8cc8cc18c75343d283af7c4825c - stable 7c5c67aa294444b53f697dc3ddce61b33ff8badd
3+

Diff for: ‎SPECS/kernel/CVE-2023-35823.nopatch

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
CVE-2023-35823 - patched in 5.10.180.1 - (generated by autopatch tool)
2+
upstream 30cf57da176cca80f11df0d9b7f71581fe601389 - stable 7dac96e9cc985328ec1fae92f0c245f559dc0e11
3+

Diff for: ‎SPECS/kernel/CVE-2023-35824.nopatch

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
CVE-2023-35824 - patched in 5.10.180.1 - (generated by autopatch tool)
2+
upstream 5abda7a16698d4d1f47af1168d8fa2c640116b4a - stable e9d64e90a0ada4d00ac6562e351ef10ae7d9b911
3+

Diff for: ‎SPECS/kernel/CVE-2023-35829.nopatch

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
CVE-2023-35829 - patched in 5.10.180.1 - (generated by autopatch tool)
2+
upstream 3228cec23b8b29215e18090c6ba635840190993d - stable de19d02d734ef29f5dbd2c12fe810fa960ecd83f
3+

0 commit comments

Comments
 (0)