CVE fix#267
Merged
Merged
Conversation
The time crate prior to 0.3.47 is vulnerable to a stack-exhaustion DoS when parsing untrusted input with the RFC 2822 well-known format (GHSA-r6v5-fh4h-64xc / CVE-2026-25727). Upgrade time to 0.3.47 in the agent and hypervisor workspaces, which clears the GitHub Dependabot alert filed against hypervisor/Cargo.lock. agent/Cargo.lock changes are limited to the time family (time, time-core, time-macros, num-conv). hypervisor/Cargo.lock additionally pulls in serde 1.0.228 (with the new serde_core split crate), serde_derive 1.0.228, deranged 0.5.x and syn 2.0.87 because time 0.3.47 now depends on serde_core ^1.0.220. All of these are SemVer-compatible patch/minor bumps with no API breakage. Assisted-by: CodeBuddy:Claude-Opus-4.7 Signed-off-by: Yi Wang <foxywang@tencent.com>
…50711 vmm-sys-util < 0.12.0 has a flaw in FamStructWrapper::deserialize that fails to verify header length matches the flexible array length, allowing out-of-bounds memory access from Rust-safe code (CVE-2023-50711, GHSA-875g-mfp6-g7f9). Switch hypervisor/rate_limiter to the workspace-pinned vmm-sys-util 0.12.1, matching every other crate in the hypervisor workspace and removing the last reference to the affected 0.11.x line. Refresh CubeShim/Cargo.lock accordingly: vmm-sys-util 0.11.2 is removed from the dependency graph. The remaining lock churn is purely textual renaming from "vmm-sys-util 0.12.1" to "vmm-sys-util" (cargo drops the version suffix once only one version is present); no other crate or version is affected. Assisted-by: CodeBuddy:Claude-Opus-4.7 Signed-off-by: Yi Wang <foxywang@tencent.com>
bytes >= 1.2.1, < 1.11.1 has an unchecked addition in BytesMut::reserve (unique reclaim path) that can wrap usize in release builds, causing self.cap to exceed the actual allocation and leading to out-of-bounds slices in subsequent APIs such as spare_capacity_mut() (CVE-2026-25541, GHSA-434x-w66g-qw3r, RUSTSEC-2026-0007). bytes is a transitive dependency in both the hypervisor workspace and the CubeShim workspace; refresh both Cargo.lock files together so 'make shim' (which links hypervisor via path) builds with --locked. No Cargo.toml change is required and no other dependency is touched. Assisted-by: CodeBuddy:Claude-Opus-4.7 Signed-off-by: Yi Wang <foxywang@tencent.com>
bytes >= 1.2.1, < 1.11.1 has an unchecked addition in BytesMut::reserve (unique reclaim path) that can wrap usize in release builds, causing self.cap to exceed the actual allocation and leading to out-of-bounds slices in subsequent APIs such as spare_capacity_mut() (CVE-2026-25541, GHSA-434x-w66g-qw3r, RUSTSEC-2026-0007). bytes is a transitive dependency in the agent workspace and its libs sub-workspace; refresh both Cargo.lock files to pin bytes 1.11.1. No Cargo.toml change is required and no other dependency is touched. Assisted-by: CodeBuddy:Claude-Opus-4.7 Signed-off-by: Yi Wang <foxywang@tencent.com>
…hv3f-hcfr) atty is unmaintained: the maintainer has been unreachable for over a year, no fix release is available, and Dependabot reports a potential unaligned read on Windows when a custom global allocator is used (GHSA-g98v-hv3f-hcfr). atty is not a direct dependency of this repository; it is pulled in transitively via env_logger 0.8.x / 0.9.x. env_logger 0.10 replaced atty with is-terminal, so bumping all four hypervisor crates that pin env_logger removes atty from the dependency graph. CubeShim links hypervisor through a path dependency (notably virtiofsd -> env_logger 0.8.4), so refresh both hypervisor/Cargo.lock and CubeShim/Cargo.lock together to keep 'make shim --locked' working. The codebase only uses env_logger::init() / env_logger::try_init(), which are stable across 0.8 -> 0.10, so no source change is required. This commit removes the atty link via env_logger. The agent workspace still pulls atty transitively through clap 3.0.1; that path will be addressed when clap is upgraded to v4. Assisted-by: CodeBuddy:Claude-Opus-4.7 Signed-off-by: Yi Wang <foxywang@tencent.com>
Collaborator
|
/cubebot review |
|
Claude finished @kinwin-ustc's task in 1m 29s —— View job Review of PR #267 — CVE FixI've reviewed all 5 commits. Overall this is a clean, well-structured security patch PR. Detailed findings below. Summary
Per-Commit Review1.
2.
3.
4.
5.
Additional Observations
VerdictApproved. This PR correctly fixes 5 distinct security advisories with no regression risk. The commit organization (one CVE per commit, coordinated lockfile updates for dependent workspaces, clear messages) makes this an exemplar security patch PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Address five Dependabot security alerts reported against this repository.
All fixes are dependency-only (no business logic changes); each commit is
independently buildable via
make shimto keepgit bisectclean.Alerts Fixed
ee9b9c4time0.3.36 → 0.3.471725951vmm-sys-utilinrate_limiter0.11.1 → 0.12.1a004cc4bytesto 1.11.1 (transitive)d195743bytesto 1.11.1 (transitive)70ffc5cenv_loggerto 0.10.2, dropping unmaintainedattyNotes on Commit Layout
bytesandenv_loggerupdates touch bothhypervisor/Cargo.lockandCubeShim/Cargo.lockin a single commit, because CubeShim linkshypervisorvia apathdependency andmake shim --lockedrequiresboth lockfiles to stay in sync. The
agentworkspace is independent andis upgraded in its own commit.
Cargo.tomlchange forbytes(transitive dep, lockfile only).env_loggerupgrade also removesattyfrom the dependency graph forthe hypervisor and shim builds; the codebase only uses
env_logger::init()/try_init()which are stable across 0.8 → 0.10.Verification
make shimpasses for every commit in this PR (verified viagit checkout <SHA> && make shimfor each).Cargo.tomlAPI consumers need to change;cargo build --release --lockedsucceeds end-to-end.Checklist
Signed-off-by(DCO).Assisted-by: CodeBuddy:Claude-Opus-4.7perAGENTS.md.