moby-engine: patch for CVE-2026-78662, CVE-2026-56855, CVE-2026-84304, CVE-2026-37236 [HIGH] - #18796
Draft
Muhammad Falak R Wani (mfrw) wants to merge 1 commit into
Draft
moby-engine: patch for CVE-2026-78662, CVE-2026-56855, CVE-2026-84304, CVE-2026-37236 [HIGH]#18796Muhammad Falak R Wani (mfrw) wants to merge 1 commit into
Muhammad Falak R Wani (mfrw) wants to merge 1 commit into
Conversation
…CVE-2026-37236 [HIGH] Backport fixes for four CVEs in vendored Go dependencies. Each was verified against the actual v25.0.3 vendored tree rather than from advisory metadata alone. CVE-2026-78662 golang.org/x/crypto/ssh v0.17.0 Patch30 CVE-2026-56855 golang.org/x/crypto/ssh v0.17.0 Patch31 CVE-2026-84304 google.golang.org/grpc v1.58.3 Patch32 CVE-2026-37236 grpc-gateway/v2 v2.16.0 Patch33 Notes for future rebases: Patch30 must stay ordered before Patch31; it adds the sync/atomic import that Patch31 relies on. Applying Patch31 alone fails to build with "undefined: atomic". OSV lists 86efde54 as the fix for CVE-2026-78662, but that commit actually fixes CVE-2026-56855. The correct fix for CVE-2026-78662 is a6cdac6084 (Gerrit CL 826504). Patch31 squashes two further upstream commits beyond the CVE fix itself: - 3c7c86938f45, the channel half of CVE-2026-39830. Only the mux half was carried previously. Without it, returning an error for unexpected message types breaks every SendRequest(wantReply=true), so exec, shell, pty-req and subsystem would fail the connection with "ssh: unexpected message type 99". - e3e62d9601ec (golang/go#79658), which fixes a busy-loop in the drain path introduced by the above. Once the channel is torn down and ch.msg is closed, "case <-ch.msg" becomes permanently ready and spins at 100% CPU. The same defect already ships in the mux.go drain loop from CVE-2026-39830.patch, so the comma-ok guard is applied to both call sites. Upstream's published diff for e3e62d9 only touches channel.go; the mux.go guard is taken from x/crypto master. CVE-2026-84304 is hand-adapted rather than cherry-picked. Upstream targets grpc >= 1.83 and its mem package, which does not exist here, so receive-buffer compaction is reimplemented against 1.58.3's bytes.Buffer and sync.Pool design. grpc is deliberately not bumped: 1.58.3 to 1.83.1 spans 25 minor releases and would cascade into buildkit, containerd and swarmkit. CVE-2026-37236 is ported faithfully as opt-in, matching upstream, via WithDisableHTTPMethodOverride. grpc-gateway is vendored but unreachable from dockerd, so deviating from upstream behaviour in vendored code adds risk with no benefit. Verified: all four apply in spec order under patch -p1 --fuzz=0, gofmt clean, only the intended vendored files change, and cmd/dockerd and cmd/docker-proxy build. The busy-loop was reproduced and then confirmed fixed A/B. Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
microsoft-github-policy-service
Bot
added
Packaging
3.0-dev
Muhammad Falak R Wani (mfrw)
requested a review
from Kanishk Bansal (Kanishk-Bansal)
September 11, 2026 13:25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport fixes for four CVEs in vendored Go dependencies. Each was
verified against the actual v25.0.3 vendored tree rather than from
advisory metadata alone.
CVE-2026-78662 golang.org/x/crypto/ssh v0.17.0 Patch30
CVE-2026-56855 golang.org/x/crypto/ssh v0.17.0 Patch31
CVE-2026-84304 google.golang.org/grpc v1.58.3 Patch32
CVE-2026-37236 grpc-gateway/v2 v2.16.0 Patch33
Notes for future rebases:
Patch30 must stay ordered before Patch31; it adds the sync/atomic
import that Patch31 relies on. Applying Patch31 alone fails to build
with "undefined: atomic".
OSV lists 86efde54 as the fix for CVE-2026-78662, but that commit
actually fixes CVE-2026-56855. The correct fix for CVE-2026-78662 is
a6cdac6084 (Gerrit CL 826504).
Patch31 squashes two further upstream commits beyond the CVE fix
itself:
3c7c86938f45, the channel half of CVE-2026-39830. Only the mux
half was carried previously. Without it, returning an error for
unexpected message types breaks every SendRequest(wantReply=true),
so exec, shell, pty-req and subsystem would fail the connection
with "ssh: unexpected message type 99".
e3e62d9601ec (x/crypto/ssh: Spinloop in (*channel).SendRequest since 3c7c869 golang/go#79658), which fixes a busy-loop in the
drain path introduced by the above. Once the channel is torn down
and ch.msg is closed, "case <-ch.msg" becomes permanently ready
and spins at 100% CPU. The same defect already ships in the mux.go
drain loop from CVE-2026-39830.patch, so the comma-ok guard is
applied to both call sites. Upstream's published diff for e3e62d9
only touches channel.go; the mux.go guard is taken from x/crypto
master.
CVE-2026-84304 is hand-adapted rather than cherry-picked. Upstream
targets grpc >= 1.83 and its mem package, which does not exist here,
so receive-buffer compaction is reimplemented against 1.58.3's
bytes.Buffer and sync.Pool design. grpc is deliberately not bumped:
1.58.3 to 1.83.1 spans 25 minor releases and would cascade into
buildkit, containerd and swarmkit.
CVE-2026-37236 is ported faithfully as opt-in, matching upstream, via
WithDisableHTTPMethodOverride. grpc-gateway is vendored but
unreachable from dockerd, so deviating from upstream behaviour in
vendored code adds risk with no benefit.
Verified: all four apply in spec order under patch -p1 --fuzz=0, gofmt
clean, only the intended vendored files change, and cmd/dockerd and
cmd/docker-proxy build. The busy-loop was reproduced and then
confirmed fixed A/B.
Signed-off-by: Muhammad Falak R Wani falakreyaz@gmail.com