From 821bc14ff417a4778d903ea8cb8e601eefe35939 Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Mon, 7 Sep 2026 14:56:23 +0000 Subject: [PATCH] Patch moby-engine for CVE-2026-78662, CVE-2026-56855 --- SPECS/moby-engine/CVE-2026-56855.patch | 49 ++++++++++++++ SPECS/moby-engine/CVE-2026-78662.patch | 92 ++++++++++++++++++++++++++ SPECS/moby-engine/moby-engine.spec | 7 +- 3 files changed, 147 insertions(+), 1 deletion(-) create mode 100644 SPECS/moby-engine/CVE-2026-56855.patch create mode 100644 SPECS/moby-engine/CVE-2026-78662.patch diff --git a/SPECS/moby-engine/CVE-2026-56855.patch b/SPECS/moby-engine/CVE-2026-56855.patch new file mode 100644 index 00000000000..9624ab78bf5 --- /dev/null +++ b/SPECS/moby-engine/CVE-2026-56855.patch @@ -0,0 +1,49 @@ +From fafa67408307f815578c79cbaa6e5a09cbc60d84 Mon Sep 17 00:00:00 2001 +From: Nicola Murino +Date: Sat, 13 Jun 2026 11:48:20 +0200 +Subject: [PATCH] ssh: reject unexpected message types on established channels + +ch.msg is only read while the channel open or a channel request with a +reply is pending, so anything the default arm of channel.handlePacket +delivered to it was never consumed. The blocking send there let a +misbehaving peer fill the buffer with well-formed but unexpected message +types carrying a valid channel id and stall the mux read loop, +deadlocking the whole connection. + +No conforming peer sends such messages during the connection protocol. +Treat them as a protocol error and tear the connection down, as +handleUnknownChannelPacket already does for the same messages when the +channel id is not in use. + +Fixes CVE-2026-56855 +Fixes golang/go#81317 + +Change-Id: I87420dfe68fcb62a17df4b47dc5ffb6ccd72ba26 +Reviewed-on: https://go-review.googlesource.com/c/crypto/+/826524 +Reviewed-by: Roland Shoemaker +LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com +Auto-Submit: Neal Patel +Reviewed-by: Nicholas Husin +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/golang/crypto/commit/86efde54dc7069251a8b007026c500d28e4239ce.patch +--- + vendor/golang.org/x/crypto/ssh/channel.go | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/vendor/golang.org/x/crypto/ssh/channel.go b/vendor/golang.org/x/crypto/ssh/channel.go +index b80b8be..9bc249e 100644 +--- a/vendor/golang.org/x/crypto/ssh/channel.go ++++ b/vendor/golang.org/x/crypto/ssh/channel.go +@@ -483,7 +483,8 @@ func (ch *channel) handlePacket(packet []byte) error { + + ch.incomingRequests <- &req + default: +- ch.msg <- msg ++ // No other message type is expected on an established channel. ++ return fmt.Errorf("ssh: unexpected message type %d on channel %d", packet[0], ch.localId) + } + return nil + } +-- +2.45.4 + diff --git a/SPECS/moby-engine/CVE-2026-78662.patch b/SPECS/moby-engine/CVE-2026-78662.patch new file mode 100644 index 00000000000..c7ed74ed07c --- /dev/null +++ b/SPECS/moby-engine/CVE-2026-78662.patch @@ -0,0 +1,92 @@ +From c186385df45996d023af5cb36432440091b734ff Mon Sep 17 00:00:00 2001 +From: Nicola Murino +Date: Sat, 13 Jun 2026 11:54:07 +0200 +Subject: [PATCH] ssh: drop traffic on undecided channels + +A channel in the mux's chanList is not usable until it is established: +an outbound channel has no confirmed remote id until the peer's open +confirmation, and an inbound channel is not serviced by the application +until it is accepted. handlePacket processed any channel message on it, +so a misbehaving peer could flood channel requests and block the mux +read loop on the send to incomingRequests, deadlocking the connection, +or close an outbound channel before confirming it, making the victim +tear down a half-initialized channel and emit a close for remote id 0, +an unrelated channel of the peer. + +No such packet can be legitimate: the peer learns an inbound channel's +local id only from the confirmation we have not sent yet, and on an +outbound channel RFC 4254 lets it answer the open request only with a +confirmation or a failure. + +Add an established flag, set when the channel becomes usable: for an +outbound channel when the open response is received, for an inbound +channel by Accept before the confirmation is sent. Until then +handlePacket drops every packet other than the open response. The flag +is separate from decided, which Reject also sets: a rejected channel is +decided but must never carry traffic. + +Fixes CVE-2026-78662 +Fixes golang/go#81316 + +Change-Id: Ib0983bb216a49808a2db1f4a4d92ee9fe38a3c51 +Reviewed-on: https://go-review.googlesource.com/c/crypto/+/826504 +Auto-Submit: Gopher Robot +LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com +Reviewed-by: Roland Shoemaker +Reviewed-by: Neal Patel +Reviewed-by: Nicholas Husin +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/golang/crypto/commit/a6cdac60840750226b15617ac8858be44361b36b.patch +--- + vendor/golang.org/x/crypto/ssh/channel.go | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/vendor/golang.org/x/crypto/ssh/channel.go b/vendor/golang.org/x/crypto/ssh/channel.go +index 77bac19..b80b8be 100644 +--- a/vendor/golang.org/x/crypto/ssh/channel.go ++++ b/vendor/golang.org/x/crypto/ssh/channel.go +@@ -172,6 +172,12 @@ type channel struct { + // (for outbound channels) or received (for inbound channels). + decided bool + ++ // established is set to true once the channel is open and may carry normal ++ // channel traffic: for an outbound channel when the peer's open ++ // confirmation is received, for an inbound channel when the local side ++ // accepts it. It is set and read from different goroutines. ++ established atomic.Bool ++ + // direction contains either channelOutbound, for channels created + // locally, or channelInbound, for channels created by the peer. + direction channelDirection +@@ -410,10 +416,20 @@ func (ch *channel) responseMessageReceived() error { + return errors.New("ssh: duplicate response received for channel") + } + ch.decided = true ++ ch.established.Store(true) + return nil + } + + func (ch *channel) handlePacket(packet []byte) error { ++ // Only the open response is expected before the channel is established. ++ if !ch.established.Load() { ++ switch packet[0] { ++ case msgChannelOpenConfirm, msgChannelOpenFailure: ++ default: ++ return nil ++ } ++ } ++ + switch packet[0] { + case msgChannelData, msgChannelExtendedData: + return ch.handleData(packet) +@@ -518,6 +534,7 @@ func (ch *channel) Accept() (Channel, <-chan *Request, error) { + MaxPacketSize: ch.maxIncomingPayload, + } + ch.decided = true ++ ch.established.Store(true) + if err := ch.sendMessage(confirm); err != nil { + return nil, nil, err + } +-- +2.45.4 + diff --git a/SPECS/moby-engine/moby-engine.spec b/SPECS/moby-engine/moby-engine.spec index c77337ebe09..416bcbc70a7 100644 --- a/SPECS/moby-engine/moby-engine.spec +++ b/SPECS/moby-engine/moby-engine.spec @@ -3,7 +3,7 @@ Summary: The open-source application container engine Name: moby-engine Version: 25.0.3 -Release: 20%{?dist} +Release: 21%{?dist} License: ASL 2.0 Group: Tools/Container URL: https://mobyproject.org @@ -45,6 +45,8 @@ Patch26: CVE-2026-61712.patch Patch27: CVE-2026-75593.patch Patch28: CVE-2026-61711.patch Patch29: CVE-2026-17106.patch +Patch30: CVE-2026-56855.patch +Patch31: CVE-2026-78662.patch %{?systemd_requires} @@ -140,6 +142,9 @@ fi %{_unitdir}/* %changelog +* Mon Sep 07 2026 Azure Linux Security Servicing Account - 25.0.3-21 +- Patch for CVE-2026-78662, CVE-2026-56855 + * Thu Aug 27 2026 Jyoti Kanase - 25.0.3-20 - Patch for CVE-2026-61711, CVE-2026-61712, CVE-2026-75593, CVE-2026-17106