Skip to content

[AutoPR- Security] Patch cloud-hypervisor for CVE-2026-24799 [MEDIUM] #15746

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
azurelinux-security wants to merge 2 commits into from
Closed

[AutoPR- Security] Patch cloud-hypervisor for CVE-2026-24799 [MEDIUM] #15746

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
36042e9
Patch cloud-hypervisor for CVE-2026-24799
azurelinux-security Feb 6, 2026
2aa0851
Modified path in patch
jykanase Feb 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions SPECS/cloud-hypervisor/CVE-2026-24799.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
From dd00211116f9b7da04772f6404aff5986a2b54e2 Mon Sep 17 00:00:00 2001
From: AllSpark <allspark@microsoft.com>
Date: Fri, 6 Feb 2026 05:06:56 +0000
Subject: [PATCH] Backport: Fix buffer overflow in zlib inflate extra header
copy by bounding len against extra_max (from upstream patch)

Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Upstream-reference: AI Backport of https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1.patch
---
inflate.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/inflate.c b/inflate.c
index cd01857..d758a1c 100644
--- a/inflate.c
+++ b/inflate.c
@@ -758,10 +758,10 @@ int flush;
copy = state->length;
if (copy > have) copy = have;
if (copy) {
+ len = state->head->extra_len - state->length;
if (state->head != Z_NULL &&
Copy link
Copy Markdown
Contributor

@kgodara912 kgodara912 Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not correct. We are checking, state->head != Z_NULL but before that we have already dereferenced it in the line above as state->head->extra_len. Please modify the patch accordingly. The len = condition can be moved inside if after the other two checks.

state->head->extra != Z_NULL &&
- (len = state->head->extra_len - state->length) <
- state->head->extra_max) {
+ len < state->head->extra_max) {
zmemcpy(state->head->extra + len, next,
len + copy > state->head->extra_max ?
state->head->extra_max - len : copy);
--
2.45.4

7 changes: 6 additions & 1 deletion SPECS/cloud-hypervisor/cloud-hypervisor.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
Summary: Cloud Hypervisor is an open source Virtual Machine Monitor (VMM) that runs on top of KVM.
Name: cloud-hypervisor
Version: 32.0
Release: 7%{?dist}
Release: 8%{?dist}
License: ASL 2.0 OR BSD-3-clause
Vendor: Microsoft Corporation
Distribution: Mariner
Expand All @@ -28,6 +28,7 @@ Patch2: CVE-2023-50711-vhost.patch
Patch3: CVE-2023-50711-versionize.patch
Patch4: CVE-2025-1744.patch
Patch5: CVE-2024-43806.patch
Patch6: CVE-2026-24799.patch
%endif

Conflicts: cloud-hypervisor-cvm
Expand Down Expand Up @@ -83,6 +84,7 @@ tar xf %{SOURCE1}
pushd vendor/libz-sys/src/zlib
%patch0 -p1
%patch4 -p1
%patch6 -p1
Copy link
Copy Markdown
Contributor

@bhagyapathak bhagyapathak Feb 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why patch 5 application is missing?

Copy link
Copy Markdown
Contributor

@Kanishk-Bansal Kanishk-Bansal Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is not missing it is getting applied at https://github.com/azurelinux-security/azurelinux/blob/2aa085167e7e84e7ac093fd2d13761e5893a2683/SPECS/cloud-hypervisor/cloud-hypervisor.spec#L92

Copy link
Copy Markdown
Contributor

@bhagyapathak bhagyapathak Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Recommend differentiating patch scope via naming and grouping for clarity. Prefix patch filenames based on target (e.g., zlib-, cloud-hypervisor-). This will improve maintainability and reviewability.

popd
%patch1 -p1
%patch2 -p1
Expand Down Expand Up @@ -168,6 +170,9 @@ cargo build --release --target=%{rust_musl_target} --package vhost_user_block %{
%license LICENSE-BSD-3-Clause

%changelog
* Fri Feb 06 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 32.0-8
- Patch for CVE-2026-24799

* Thu May 22 2025 Sreeniavsulu Malavathula <v-smalavathu@microsoft.com> - 32.0-7
- Patch CVE-2024-43806

Expand Down
Loading