Skip to content

Commit 3bac90c

Browse files
CBL-Mariner-Botazurelinux-securityv-aaditya
authored
Merge PR "[AUTO-CHERRYPICK] [AutoPR- Security] Patch fluent-bit for CVE-2025-63657 [HIGH] - branch 3.0-dev" #16778
Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: Aditya Singh <v-aditysing@microsoft.com>
1 parent 6bb3acb commit 3bac90c

2 files changed

Lines changed: 103 additions & 2 deletions

File tree

‎SPECS/fluent-bit/CVE-2025-63657.patch‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
From f9d883c5792fc1b3f9cd29dd8ff255c6c99944a2 Mon Sep 17 00:00:00 2001
2+
From: Eduardo Silva <eduardo@chronosphere.io>
3+
Date: Thu, 9 Apr 2026 12:11:57 -0600
4+
Subject: [PATCH] server: parser: harden boundary checks
5+
6+
Tighten parser and helper validation around explicit lengths and
7+
buffer boundaries.
8+
9+
Require exact header literal matches, validate chunk length tokens,
10+
and guard helper routines that previously trusted inconsistent
11+
pointer or length state.
12+
13+
Verified by rebuilding with cmake --build build and replaying the
14+
reported malformed request fixtures against build/bin/monkey.
15+
16+
Signed-off-by: Eduardo Silva <eduardo@chronosphere.io>
17+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
18+
Upstream-reference: https://github.com/monkey/monkey/commit/ffe0d0ed1b074ea6f3965c37bb754e9f19130a82.patch
19+
---
20+
lib/monkey/include/monkey/mk_http_parser.h | 6 +++++-
21+
lib/monkey/mk_server/mk_http_parser.c | 10 ++++++++++
22+
lib/monkey/mk_server/mk_mimetype.c | 7 ++++++-
23+
lib/monkey/mk_server/mk_user.c | 2 +-
24+
4 files changed, 22 insertions(+), 3 deletions(-)
25+
26+
diff --git a/lib/monkey/include/monkey/mk_http_parser.h b/lib/monkey/include/monkey/mk_http_parser.h
27+
index 6d45c39..5ae5c60 100644
28+
--- a/lib/monkey/include/monkey/mk_http_parser.h
29+
+++ b/lib/monkey/include/monkey/mk_http_parser.h
30+
@@ -335,7 +335,11 @@ static inline void mk_http_parser_init(struct mk_http_parser *p)
31+
32+
static inline int mk_http_parser_more(struct mk_http_parser *p, int len)
33+
{
34+
- if (abs(len - p->i) - 1 > 0) {
35+
+ if (len <= 0 || p->i < 0) {
36+
+ return MK_FALSE;
37+
+ }
38+
+
39+
+ if ((p->i + 1) < len) {
40+
return MK_TRUE;
41+
}
42+
43+
diff --git a/lib/monkey/mk_server/mk_http_parser.c b/lib/monkey/mk_server/mk_http_parser.c
44+
index 4e7aa31..898df31 100644
45+
--- a/lib/monkey/mk_server/mk_http_parser.c
46+
+++ b/lib/monkey/mk_server/mk_http_parser.c
47+
@@ -172,6 +172,16 @@ static inline void request_set(mk_ptr_t *ptr, struct mk_http_parser *p, char *bu
48+
static inline int header_cmp(const char *expected, char *value, int len)
49+
{
50+
int i = 0;
51+
+ size_t expected_len;
52+
+
53+
+ if (len < 0) {
54+
+ return -1;
55+
+ }
56+
+
57+
+ expected_len = strlen(expected);
58+
+ if ((size_t) len != expected_len) {
59+
+ return -1;
60+
+ }
61+
62+
if (len >= 8) {
63+
if (expected[0] != tolower(value[0])) return -1;
64+
diff --git a/lib/monkey/mk_server/mk_mimetype.c b/lib/monkey/mk_server/mk_mimetype.c
65+
index b86b4ef..5462ea5 100644
66+
--- a/lib/monkey/mk_server/mk_mimetype.c
67+
+++ b/lib/monkey/mk_server/mk_mimetype.c
68+
@@ -197,7 +197,12 @@ struct mk_mimetype *mk_mimetype_find(struct mk_server *server, mk_ptr_t *filenam
69+
{
70+
int j, len;
71+
72+
- j = len = filename->len;
73+
+ if (!filename->data || filename->len <= 0) {
74+
+ return NULL;
75+
+ }
76+
+
77+
+ len = filename->len;
78+
+ j = len - 1;
79+
80+
/* looking for extension */
81+
while (j >= 0 && filename->data[j] != '.') {
82+
diff --git a/lib/monkey/mk_server/mk_user.c b/lib/monkey/mk_server/mk_user.c
83+
index 7200ff0..716331a 100644
84+
--- a/lib/monkey/mk_server/mk_user.c
85+
+++ b/lib/monkey/mk_server/mk_user.c
86+
@@ -46,7 +46,7 @@ int mk_user_init(struct mk_http_session *cs, struct mk_http_request *sr,
87+
}
88+
89+
limit = mk_string_char_search(sr->uri_processed.data + offset, '/',
90+
- sr->uri_processed.len);
91+
+ sr->uri_processed.len - offset);
92+
93+
if (limit == -1) {
94+
limit = (sr->uri_processed.len) - offset;
95+
--
96+
2.45.4
97+

‎SPECS/fluent-bit/fluent-bit.spec‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Fast and Lightweight Log processor and forwarder for Linux, BSD and OSX
22
Name: fluent-bit
33
Version: 3.1.10
4-
Release: 4%{?dist}
4+
Release: 5%{?dist}
55
License: Apache-2.0
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
@@ -19,6 +19,7 @@ Patch8: CVE-2025-12970.patch
1919
Patch9: CVE-2025-12977.patch
2020
Patch10: CVE-2025-12969.patch
2121
Patch11: CVE-2025-62408.patch
22+
Patch12: CVE-2025-63657.patch
2223
BuildRequires: bison
2324
BuildRequires: cmake
2425
BuildRequires: cyrus-sasl-devel
@@ -93,6 +94,9 @@ Development files for %{name}
9394
%{_libdir}/fluent-bit/*.so
9495

9596
%changelog
97+
* Mon Apr 20 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.1.10-5
98+
- Patch for CVE-2025-63649, CVE-2025-63656 and CVE-2025-63657
99+
96100
* Wed Dec 17 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.1.10-4
97101
- Patch for CVE-2025-62408
98102

@@ -120,7 +124,7 @@ Development files for %{name}
120124
* Tue Dec 10 2024 Sudipta Pandit <sudpandit@microsoft.com> - 3.1.9-2
121125
- Backport fixes for CVE-2024-27532
122126

123-
* Tue Nov 23 2024 Paul Meyer <paul.meyer@microsoft.com> - 3.1.9-1
127+
* Sat Nov 23 2024 Paul Meyer <paul.meyer@microsoft.com> - 3.1.9-1
124128
- Update to 3.1.9 to enable Lua filter plugin using system luajit library.
125129
- Remove patches for CVE-2024-25629 and CVE-2024-28182 as they are fixed in 3.1.9.
126130
- [Jon Slobodzian] Reconciled with Fasttrack/3.0 on 11/23, updated Changelog date from 11/5.

0 commit comments

Comments
 (0)