Skip to content

[Medium] Patch rust for CVE-2026-47143 - #18232

Merged
kgodara912 merged 4 commits into
microsoft:3.0-devfrom
SumitJenaHCL:topic_rust-1.90.0-3.0
Aug 6, 2026
Merged

[Medium] Patch rust for CVE-2026-47143#18232
kgodara912 merged 4 commits into
microsoft:3.0-devfrom
SumitJenaHCL:topic_rust-1.90.0-3.0

Conversation

@SumitJenaHCL

@SumitJenaHCL Sumit Jena (SumitJenaHCL) commented Jul 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

  • The toolchain has been rebuilt successfully (or no changes were made to it)
  • The toolchain/worker package manifests are up-to-date
  • Any updated packages successfully build (or no packages were changed)
  • Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
  • Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
  • All package sources are available
  • cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
  • LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
  • All source files have up-to-date hashes in the *.signatures.json files
  • sudo make go-tidy-all and sudo make go-test-coverage pass
  • Documentation has been updated to match any changes to the build system
  • Ready to merge
Summary
  • Patch rust for CVE-2026-47143.
  • The CVE affects the vendored capstone-sys package in Rust 1.90.0.
  • Capstone's reduced-X86 decoder can dereference a NULL instruction specification when handling unsupported instruction types.
  • The upstream fix has been backported to vendor/capstone-sys-0.17.0/capstone/arch/X86/X86DisassemblerDecoder.c.
  • Upstream Patch Reference: capstone-engine/capstone@a020137

This PR also includes two follow-up changes to the same rust spec:

  • CVE-2026-25541.patch: narrowed to only the vendored bytes-1.10.1 crate (the version actually built), dropping the unused bytes-1.4.0, 1.7.1, 1.8.0, and 1.10.0 hunks.
  • rust-doc license-check warnings: relocated the rustdoc-bundled license texts (webfont / static.files licenses and the SPDX bundle) to %license, and removed auto-generated *bsd* API/platform doc pages whose names trip the license-name heuristic.
Change Log
  • new file: SPECS/rust/CVE-2026-47143.patch
  • modified: SPECS/rust/rust.spec
  • modified: SPECS/rust/CVE-2026-25541.patch
Does this affect the toolchain?

NO

Links to CVEs
Test Methodology
  • Local package build was successful.
  • Package tests passed with RUN_CHECK=y.
  • All rust patches apply sequentially with zero fuzz.
  • License-check fix validated against the built rust-doc file tree: the bundled license texts are tagged %license and the flagged *bsd* pages are removed, leaving no license-name matches under the doc directory.

@SumitJenaHCL
Sumit Jena (SumitJenaHCL) requested a review from a team as a code owner July 28, 2026 04:08
@azure-pipelines

azure-pipelines Bot commented Jul 28, 2026

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

@microsoft-github-policy-service microsoft-github-policy-service Bot added Packaging 3.0-dev PRs Destined for AzureLinux 3.0 labels Jul 28, 2026
@SumitJenaHCL
Sumit Jena (SumitJenaHCL) marked this pull request as draft July 28, 2026 04:09
@SumitJenaHCL

Sumit Jena (SumitJenaHCL) commented Jul 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

Buddy Build URL - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1169578&view=results

@SumitJenaHCL
Patch rust for CVE-2026-47143
e81c1e8
@SumitJenaHCL
Update rust CVE-2026-25541 patch and fix rust-doc license check warnings
f96c54f 
- Narrow CVE-2026-25541.patch to the vendored bytes-1.10.1 crate
- Relocate rustdoc-bundled license texts to %license and drop *bsd* doc pages
@SumitJenaHCL
Sumit Jena (SumitJenaHCL) marked this pull request as ready for review July 28, 2026 08:13
@azure-pipelines

azure-pipelines Bot commented Jul 28, 2026

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

KavyaSree2610
Kavya Sree Kaitepalli (KavyaSree2610) requested changes Jul 30, 2026
View reviewed changes
Comment thread SPECS/rust/rust.spec
Comment thread SPECS/rust/rust.spec
Comment thread SPECS/rust/CVE-2026-25541.patch
Comment thread SPECS/rust/rust.spec Outdated
@SumitJenaHCL

Sumit Jena (SumitJenaHCL) commented Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

Triggered Buddy build to verify license warnings : https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1171428&view=results

@SumitJenaHCL
Address rust PR review feedback (changelog, patch, license warnings)
d81160f 
- Restore changelog release-number order (1.90.0-1 before 1.86.0-10)

- Note the CVE-2026-25541.patch update in the changelog

- Fix CVE-2026-25541.patch: add trailing newline and symmetric checksum no-newline marker (silences 'patch unexpectedly ends in middle of line')

- Fix rust-doc license warnings: move bundled SPDX license texts out of the doc tree into the license dir, and add license_file_exceptions.json entries for the HTML doc assets
@SumitJenaHCL
Sumit Jena (SumitJenaHCL) requested a review from a team as a code owner July 31, 2026 09:42
@microsoft-github-policy-service microsoft-github-policy-service Bot added the specs-extended PR to fix SPECS-EXTENDED label Jul 31, 2026
@KavyaSree2610

Kavya Sree Kaitepalli (KavyaSree2610) commented Jul 31, 2026

Copy link
Copy Markdown

Buddy build: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1172144&view=results

@SumitJenaHCL

Sumit Jena (SumitJenaHCL) commented Jul 31, 2026

Copy link
Copy Markdown
Author

Buddy build: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1172144&view=results

Buddy Build has passed.

@KavyaSree2610 Kavya Sree Kaitepalli (KavyaSree2610) removed the specs-extended PR to fix SPECS-EXTENDED label Aug 3, 2026
KavyaSree2610
Kavya Sree Kaitepalli (KavyaSree2610) approved these changes Aug 3, 2026
View reviewed changes

@KavyaSree2610 Kavya Sree Kaitepalli (KavyaSree2610) left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Patch Analysis (the patch applies cleanly)

  • Buddy Build successful
  • Patch applied during the build (check rpm.log)
Image
  • Patches include an upstream reference
  • PR has security tag

@KavyaSree2610 Kavya Sree Kaitepalli (KavyaSree2610) added the ready-for-stable-review PR has passed initial review and is now ready for a second-level stable maintainer review label Aug 3, 2026
kgodara912
kgodara912 requested changes Aug 4, 2026
View reviewed changes

@kgodara912 kgodara912 left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the previous rust CVEs, we used to update multiple other dependent packages. Could you please check once if that is no longer true? Please take a look at other rust PRs. Though it may be the case that we don't need update but just confirm once.

Comment thread SPECS/rust/CVE-2026-47143.patch
vendor/capstone-sys-0.17.0/capstone/arch/X86/X86DisassemblerDecoder.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/vendor/capstone-sys-0.17.0/capstone/arch/X86/X86DisassemblerDecoder.c b/vendor/capstone-sys-0.17.0/capstone/arch/X86/X86DisassemblerDecoder.c

@kgodara912 kgodara912 Aug 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This crate also has vendor/capstone-sys-0.17.0/.cargo-checksum.json checksum file which has the X86DisassemblerDecoder.c file checksum present. So, if this module is compiled in future, then the compilation will fail as checksum doesn't match. Though it is fine to keep the fix, there is no harm, but it should update the checksum file of the module for future compilation. Likely our current spec never compiles the file currently.

@SumitJenaHCL Sumit Jena (SumitJenaHCL) Aug 5, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated the patch to also fix the X86DisassemblerDecoder.c checksum in vendor/capstone-sys-0.17.0/.cargo-checksum.json, so it stays buildable if compiled later.

@SumitJenaHCL

Sumit Jena (SumitJenaHCL) commented Aug 5, 2026

Copy link
Copy Markdown
Author

In the previous rust CVEs, we used to update multiple other dependent packages. Could you please check once if that is no longer true? Please take a look at other rust PRs. Though it may be the case that we don't need update but just confirm once.

Hi kgodara912

I've checked on this. No dependent packages need updates. capstone-sys is only used by Miri (not built here), and the bytes CVE is already patched separately in kata-containers, netavark, rpm-ostree, and rust-afterburn.

kgodara912
kgodara912 approved these changes Aug 6, 2026
View reviewed changes

@kgodara912 kgodara912 left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Patch matches with upstream reference except checksum. The create itself doesn't seem to be compiling currently. Buddy build is successful. LGTM.

@kgodara912
kgodara912 merged commit 63c1f29 into microsoft:3.0-dev Aug 6, 2026
17 checks passed
jslobodzian added a commit that referenced this pull request Aug 10, 2026
@jslobodzian
Revert "[Medium] Patch rust for CVE-2026-47143 (#18232)"
c6a46b7 
This reverts commit 63c1f29.
jslobodzian added a commit that referenced this pull request Aug 13, 2026
@jslobodzian
Reapply "[Medium] Patch rust for CVE-2026-47143 (#18232)"
288e0cc 
This reverts commit c6a46b7.
jslobodzian added a commit that referenced this pull request Aug 14, 2026
@jslobodzian
Revert "Reapply "[Medium] Patch rust for CVE-2026-47143 (#18232)""
edf6c3a 
This reverts commit 288e0cc.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@KavyaSree2610 Kavya Sree Kaitepalli (KavyaSree2610) KavyaSree2610 approved these changes
@kgodara912 kgodara912 kgodara912 approved these changes

Assignees

No one assigned

Labels

3.0-dev PRs Destined for AzureLinux 3.0 Packaging ready-for-stable-review PR has passed initial review and is now ready for a second-level stable maintainer review security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@SumitJenaHCL @KavyaSree2610 @kgodara912 @Kanishk-Bansal