Package: release.debian.org Severity: normal Tags: trixie User: [email protected] Usertags: pu X-Debbugs-Cc: [email protected], [email protected], [email protected] Control: affects -1 + src:lxc
[ Reason ] Two low-severity security issues and one bug have been found that would be good to get fixed in trixie: * Cherry-pick fixes for CVE-2026-100395 and GHSA-4xwm-pr6h-55r8. The Security Team isn't planning a DSA for these minor issues, so the plan is to fix them via a stable point release. * Cherry-pick fix setting container_ttys environment variable. (Reported as bug #1135809.) [ Impact ] LXC in trixie is currently affected by two minor security issues and a quality of life bug. [ Tests ] I manually verified the fix for setting container_ttys environment variable works as advertised. The two security fixes been upstream for a couple of months now and no regressions have been reported. [ Risks ] Minor/none -- three targeted fixes cherry-picked from the upstream git repo. [ Checklist ] [*] *all* changes are documented in the d/changelog [*] I reviewed all changes and I approve them [*] attach debdiff against the package in (old)stable [*] the issue is verified as fixed in unstable [ Changes ] Three fixes as outlined above. [ Other info ] The source debdiff is attached.
diff --git a/debian/changelog b/debian/changelog index d25b857..fac78de 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,13 @@ +lxc (1:6.0.4-4+deb13u5) trixie; urgency=medium + + * Cherry-pick fixes for two security issues: + - CVE-2026-100395 + - GHSA-4xwm-pr6h-55r8 + * Cherry-pick fix setting container_ttys environment variable + (Closes: #1135809) + + -- Mathias Gibbens <[email protected]> Sun, 08 Nov 2026 23:35:14 +0000 + lxc (1:6.0.4-4+deb13u4) trixie; urgency=medium * Cherry-pick fix to properly free libcap-allocated memory diff --git a/debian/patches/0109-cherry-pick-fix-setting-container-ttys.patch b/debian/patches/0109-cherry-pick-fix-setting-container-ttys.patch new file mode 100644 index 0000000..a2e2f69 --- /dev/null +++ b/debian/patches/0109-cherry-pick-fix-setting-container-ttys.patch @@ -0,0 +1,73 @@ +From 8ab6ad25b596e02a37f9578175991fc6e7dc7420 Mon Sep 17 00:00:00 2001 +From: Roman Azarenko <[email protected]> +Date: Tue, 22 Apr 2025 09:16:13 +0200 +Subject: [PATCH] lxc/conf,start: fix setting container_ttys environment + variable + +Commit eae44ce19931 ("conf: fix append_ttyname()") changed the format +of `conf->ttys.tty_names`, where the `container_ttys=` prefix was +removed. + +This seems to have been taken into account in `lxc_create_ttys()` in +`src/lxc/conf.c`, however that's not enough. `do_start()` in +`src/lxc/start.c` clears the environment, and then does `putenv(...)` +directly on the value of `tty_names`. As it no longer has the +`container_ttys=` prefix, this call doesn't have the intended effect. + +This behaviour is also confirmed via `ltrace` when doing `lxc-start`: + + [pid 53587] liblxc.so.1->setenv("container_ttys", "pts/1 pts/2 pts/3 pts/4", 1) = 0 + [pid 53587] liblxc.so.1->clearenv(0, 1, 0, 0) = 0 + [pid 53587] liblxc.so.1->putenv("container=lxc") = 0 + [pid 53587] liblxc.so.1->putenv("pts/1 pts/2 pts/3 pts/4") = 0 + +Given that `do_start()` clears the environment anyway, there is no +reason for another `setenv()` call in `lxc_create_ttys()`, and a fix +is required for `putenv()` in `do_start()`. + +Change the `putenv()` call to `setenv()` in `do_start()` to account +for the change of format in `conf->ttys.tty_names`. Remove extraneous +`setenv()` from `lxc_create_ttys()`. + +Fixes #4198 + +Fixes: eae44ce19931 ("conf: fix append_ttyname()") +Signed-off-by: Roman Azarenko <[email protected]> +--- + src/lxc/conf.c | 9 --------- + src/lxc/start.c | 2 +- + 2 files changed, 1 insertion(+), 10 deletions(-) + +diff --git a/src/lxc/conf.c b/src/lxc/conf.c +index 6a6ee0942c..14fa041b71 100644 +--- a/src/lxc/conf.c ++++ b/src/lxc/conf.c +@@ -971,15 +971,6 @@ static int lxc_create_ttys(struct lxc_handler *handler) + } + } + +- if (conf->ttys.tty_names) { +- ret = setenv("container_ttys", conf->ttys.tty_names, 1); +- if (ret < 0) { +- SYSERROR("Failed to set \"container_ttys=%s\"", conf->ttys.tty_names); +- goto on_error; +- } +- TRACE("Set \"container_ttys=%s\"", conf->ttys.tty_names); +- } +- + return 0; + + on_error: +diff --git a/src/lxc/start.c b/src/lxc/start.c +index ee4bf4003b..3160459b46 100644 +--- a/src/lxc/start.c ++++ b/src/lxc/start.c +@@ -1372,7 +1372,7 @@ static int do_start(void *data) + } + + if (handler->conf->ttys.tty_names) { +- ret = putenv(handler->conf->ttys.tty_names); ++ ret = setenv("container_ttys", handler->conf->ttys.tty_names, 1); + if (ret < 0) { + SYSERROR("Failed to set environment variable for container ptys"); + goto out_warn_father; diff --git a/debian/patches/0110-cherry-pick-CVE-2026-100395.patch b/debian/patches/0110-cherry-pick-CVE-2026-100395.patch new file mode 100644 index 0000000..8ea1d27 --- /dev/null +++ b/debian/patches/0110-cherry-pick-CVE-2026-100395.patch @@ -0,0 +1,160 @@ +From 6424a91a55efc54edc25ca46e9165bd9f35b50b7 Mon Sep 17 00:00:00 2001 +From: Serge Hallyn <[email protected]> +Date: Tue, 14 Jul 2026 11:50:39 -0500 +Subject: [PATCH 1/2] lxc-copy: open hostname in a safer way +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +lxc-copy without -K updates the hostname in the container. It does +this by opening /etc/hostname in the container and writing the new +hostname to it. If /etc/hostname is a symbolic link, we can end up +ovewriting a host path. + +lxc-copy is not setuid-root, so unprivileged users can't exploit this +without help. More likely would be unprivileged users shooting +themselves in the foot and accidentally changing the hostname of the +original container. + +Fix it by using openat2(RESOLVE_IN_ROOT) to make sure that if +/etc or /etc/hostname is a symlink, it is resolved inside the +container's fs. + +Signed-off-by: Serge Hallyn <[email protected]> +Reported-by: 怀硕 <[email protected]> +--- + src/lxc/lxccontainer.c | 76 ++++++++++++++++++++++++++---------------- + 1 file changed, 47 insertions(+), 29 deletions(-) + +diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c +index ba3d988b5b..736df037ac 100644 +--- a/src/lxc/lxccontainer.c ++++ b/src/lxc/lxccontainer.c +@@ -3584,6 +3584,52 @@ struct clone_update_data { + char **hookargs; + }; + ++static int do_update_hostname(struct lxc_container *c, int flags) ++{ ++ char *path; ++ __do_close int dir = -EBADF; ++ __do_close int hfd = -EBADF; ++ __do_fclose FILE *fout = NULL; ++ struct open_how how = { ++ .flags = O_RDWR, ++ .resolve = RESOLVE_IN_ROOT ++ }; ++ ++ path = c->lxc_conf->rootfs.storage->dest; ++ if (!file_exists(path)) ++ return 0; ++ ++ dir = open(path, O_RDONLY | O_DIRECTORY | O_PATH | O_CLOEXEC); ++ if (dir < 0) ++ return 0; ++ ++ hfd = openat2(dir, "/etc/hostname", &how, sizeof(how)); ++ if (hfd < 0) ++ return 0; ++ ++ fout = fdopen(hfd, "w"); ++ if (!fout) ++ return 0; ++ hfd = -EBADF; // fclose(fout) will close hfd ++ ++ if (fprintf(fout, "%s", c->name) < 0) ++ return -1; ++ ++ return 0; ++} ++ ++static int maybe_update_hostname(struct lxc_container *c, int flags) ++{ ++ int ret = 0; ++ struct lxc_conf *conf = c->lxc_conf; ++ ++ if (!(flags & LXC_CLONE_KEEPNAME)) ++ ret = do_update_hostname(c, flags); ++ ++ lxc_storage_put(conf); ++ return ret; ++} ++ + static int clone_update_rootfs(struct clone_update_data *data) + { + struct lxc_container *c0 = data->c0; +@@ -3591,9 +3637,7 @@ static int clone_update_rootfs(struct clone_update_data *data) + int flags = data->flags; + char **hookargs = data->hookargs; + int ret = -1; +- char path[PATH_MAX]; + struct lxc_storage *bdev; +- FILE *fout; + struct lxc_conf *conf = c->lxc_conf; + + /* update hostname in rootfs */ +@@ -3662,33 +3706,7 @@ static int clone_update_rootfs(struct clone_update_data *data) + } + } + +- if (!(flags & LXC_CLONE_KEEPNAME)) { +- ret = strnprintf(path, sizeof(path), "%s/etc/hostname", bdev->dest); +- lxc_storage_put(conf); +- +- if (ret < 0) +- return -1; +- +- if (!file_exists(path)) +- return 0; +- +- if (!(fout = fopen(path, "we"))) { +- SYSERROR("unable to open %s: ignoring", path); +- return 0; +- } +- +- if (fprintf(fout, "%s", c->name) < 0) { +- fclose(fout); +- return -1; +- } +- +- if (fclose(fout) < 0) +- return -1; +- } else { +- lxc_storage_put(conf); +- } +- +- return 0; ++ return maybe_update_hostname(c, flags); + } + + static int clone_update_rootfs_wrapper(void *data) + +From fa12709a79c2b63b3918297d7505108fcc840eb6 Mon Sep 17 00:00:00 2001 +From: Shuo Huai <[email protected]> +Date: Tue, 28 Jul 2026 17:22:28 +0800 +Subject: [PATCH 2/2] lxc-copy: fix hostname truncation during clone + +The hostname update code switched from fopen() to openat2() +and fdopen(), but fdopen() does not truncate an existing file. + +Add O_TRUNC to preserve the previous fopen() behavior and avoid +leaving stale bytes after updating the hostname. + +Signed-off-by: Shuo Huai <[email protected]> +--- + src/lxc/lxccontainer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c +index 736df037ac..c820f59090 100644 +--- a/src/lxc/lxccontainer.c ++++ b/src/lxc/lxccontainer.c +@@ -3591,7 +3591,7 @@ static int do_update_hostname(struct lxc_container *c, int flags) + __do_close int hfd = -EBADF; + __do_fclose FILE *fout = NULL; + struct open_how how = { +- .flags = O_RDWR, ++ .flags = O_RDWR | O_TRUNC, + .resolve = RESOLVE_IN_ROOT + }; + diff --git a/debian/patches/0111-cherry-pick-GHSA-4xwm-pr6h-55r8.patch b/debian/patches/0111-cherry-pick-GHSA-4xwm-pr6h-55r8.patch new file mode 100644 index 0000000..7a8afca --- /dev/null +++ b/debian/patches/0111-cherry-pick-GHSA-4xwm-pr6h-55r8.patch @@ -0,0 +1,62 @@ +From 06f626091cb9f1d717cb9d63b7bc2ffdbf0c3cdf Mon Sep 17 00:00:00 2001 +From: Kartik Kenchi <[email protected]> +Date: Tue, 9 Jun 2026 12:14:46 +0530 +Subject: [PATCH] commands: validate string in lxc_cmd_get_config_item_callback + +Signed-off-by: Kartik Kenchi <[email protected]> +--- + src/lxc/commands.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/src/lxc/commands.c b/src/lxc/commands.c +index 8c6460cdcc..1454d0ebaa 100644 +--- a/src/lxc/commands.c ++++ b/src/lxc/commands.c +@@ -1028,8 +1028,19 @@ static int lxc_cmd_get_config_item_callback(int fd, struct lxc_cmd_req *req, + int cilen; + struct lxc_config_t *item; + struct lxc_cmd_rsp rsp; ++ ssize_t ret; + + memset(&rsp, 0, sizeof(rsp)); ++ ++ if (req->datalen <= 0) { ++ rsp.ret = -EINVAL; ++ return lxc_cmd_rsp_send_reap(fd, &rsp); ++ } ++ ++ ret = validate_string_request(fd, req); ++ if (ret != 0) ++ return ret; ++ + item = lxc_get_config(req->data); + cilen = item->get(req->data, NULL, 0, handler->conf, NULL); + if (cilen <= 0) + +From 19ad80ed8e6288904caaee5b7bd3c485d51a2291 Mon Sep 17 00:00:00 2001 +From: Kartik Kenchi <[email protected]> +Date: Thu, 20 Aug 2026 13:03:50 +0530 +Subject: [PATCH] commands: validate datalen in lxc_cmd_console_log_callback + +Signed-off-by: Kartik Kenchi <[email protected]> +--- + src/lxc/commands.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/src/lxc/commands.c b/src/lxc/commands.c +index 8c6460cdcc..3a8353bf2a 100644 +--- a/src/lxc/commands.c ++++ b/src/lxc/commands.c +@@ -1554,6 +1554,12 @@ static int lxc_cmd_console_log_callback(int fd, struct lxc_cmd_req *req, + rsp.ret = -EFAULT; + rsp.datalen = 0; + rsp.data = NULL; ++ ++ if (req->datalen != sizeof(struct lxc_cmd_console_log) || !req->data) { ++ rsp.ret = -EINVAL; ++ goto out; ++ } ++ + if (buffer_size <= 0) + goto out; + diff --git a/debian/patches/series b/debian/patches/series index 4a76fb0..4e49912 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -11,3 +11,6 @@ 0106-cherry-pick-CVE-2026-39402.patch 0107-cherry-pick-fix-cap_to_text.patch 0108-cherry-pick-runc-nested-containers.patch +0109-cherry-pick-fix-setting-container-ttys.patch +0110-cherry-pick-CVE-2026-100395.patch +0111-cherry-pick-GHSA-4xwm-pr6h-55r8.patch
signature.asc
Description: This is a digitally signed message part
