From 976f8b7531a6077da6bce21150ee8cdafc9d842d Mon Sep 17 00:00:00 2001 From: Nitish Bhat Date: Mon, 13 Jul 2026 20:34:44 -0700 Subject: [PATCH 1/3] =?UTF-8?q?fix(security):=20bump=20Go=201.26.4=20?= =?UTF-8?q?=E2=86=92=201.26.5=20for=20CVE-2026-39822=20(#1599)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(security): bump Go 1.26.4 → 1.26.5 for CVE-2026-39822 Go 1.26.5 fixes CVE-2026-39822 (HIGH) — os.Root symlink following vulnerability allows directory traversal. Updated in: go.mod, Dockerfile, Dockerfile.build, Makefile, dev.env. Build container bumped from v1.6 → v1.7 and pushed to pensando registry. * docs: add plan file for Go 1.26.5 CVE remediation PR (cherry picked from commit 618db42d66085a36f839398eb96d54a01064dd58) --- Dockerfile | 2 +- Dockerfile.build | 6 +- Makefile | 4 +- dev.env | 29 +++++++++ .../2026-07-13-go-1.26.5-cve-remediation.md | 61 +++++++++++++++++++ go.mod | 2 +- 6 files changed, 97 insertions(+), 7 deletions(-) create mode 100644 dev.env create mode 100644 docs-internal/knowledge/plans/2026-07-13-go-1.26.5-cve-remediation.md diff --git a/Dockerfile b/Dockerfile index 6089ba13e..33fda9144 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -ARG GOLANG_BASE_IMG=golang:1.26.4 +ARG GOLANG_BASE_IMG=golang:1.26.5 ARG OPERATOR_CONTROLLER_BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:9.8 # Build the manager binary diff --git a/Dockerfile.build b/Dockerfile.build index 09c5d6054..eb2494afe 100644 --- a/Dockerfile.build +++ b/Dockerfile.build @@ -48,9 +48,9 @@ RUN apt-get update -y && \ RUN localedef -i en_US -f UTF-8 en_US.UTF-8 # Install Go -RUN wget https://go.dev/dl/go1.26.4.linux-amd64.tar.gz && \ - tar -C /usr/local -xzf go1.26.4.linux-amd64.tar.gz && \ - rm go1.26.4.linux-amd64.tar.gz +RUN wget https://go.dev/dl/go1.26.5.linux-amd64.tar.gz && \ + tar -C /usr/local -xzf go1.26.5.linux-amd64.tar.gz && \ + rm go1.26.5.linux-amd64.tar.gz ENV PATH="/usr/local/go/bin:${PATH}" diff --git a/Makefile b/Makefile index 07881bf0c..8a0e31db9 100644 --- a/Makefile +++ b/Makefile @@ -122,7 +122,7 @@ CONTAINER_DOCKER_SOCKET ?= /var/run/docker.sock DOCKER_GID := $(shell stat -c '%g' $(HOST_DOCKER_SOCKET)) USER_UID := $(shell id -u) USER_GID := $(shell id -g) -DOCKER_BUILDER_TAG := v1.6 +DOCKER_BUILDER_TAG := v1.7 DOCKER_BUILDER_IMAGE := $(DOCKER_REGISTRY)/gpu-operator-build:$(DOCKER_BUILDER_TAG) CONTAINER_WORKDIR := /gpu-operator # In CI environments (e.g. GitHub Actions) there is no TTY, so omit -it flags. @@ -130,7 +130,7 @@ DOCKER_IT_FLAGS := $(if $(CI),,-it) BUILD_BASE_IMG ?= ubuntu:22.04 DOCKER_CACHE_FROM ?= DOCKER_CACHE_TO ?= -GOLANG_BASE_IMG ?= golang:1.26.4 +GOLANG_BASE_IMG ?= golang:1.26.5 OPERATOR_CONTROLLER_BASE_IMAGE ?= registry.access.redhat.com/ubi9/ubi-minimal:9.8 # Helm binary installed into the build-shell image (Dockerfile.build). Pin the # version and its published sha256 together; bump both when upgrading. diff --git a/dev.env b/dev.env new file mode 100644 index 000000000..72ad5780e --- /dev/null +++ b/dev.env @@ -0,0 +1,29 @@ +GOFLAGS = "-mod=mod" +DOCKER_REGISTRY ?= registry.test.pensando.io:5000 +BUILD_BASE_IMG = registry.test.pensando.io:5000/ubuntu:22.04 +GOLANG_BASE_IMG = registry.test.pensando.io:5000/golang:1.26.5 +INSECURE_REGISTRY = registry.test.pensando.io:5000 + +E2E_INIT_CONTAINER_IMAGE = registry.test.pensando.io:5000/busybox:1.36 +E2E_KUBE_RBAC_PROXY_CURL_IMAGE = registry.test.pensando.io:5000/curl:7.78.0 +E2E_UBUNTU_BASE_IMAGE = registry.test.pensando.io:5000/ubuntu +E2E_MINIO_IMAGE = registry.test.pensando.io:5000/minio/minio:latest +E2E_EXPORTER_MOCK_IMAGE = registry.test.pensando.io:5000/device-metrics-exporter/exporter-mock:v1 +E2E_EXPORTER_MOCK_IMAGE_2 = registry.test.pensando.io:5000/device-metrics-exporter/exporter-mock:v2 +E2E_EXPORTER_IMAGE = registry.test.pensando.io:5000/device-metrics-exporter:latest +E2E_DEVICE_PLUGIN_IMAGE = registry.test.pensando.io:5000/device-plugin-partition:v8 +E2E_NODE_LABELLER_IMAGE = registry.test.pensando.io:5000/node-labeller-partition:v8 +E2E_DEVICE_PLUGIN_IMAGE_2 = registry.test.pensando.io:5000/device-plugin-partition:v7 +E2E_NODE_LABELLER_IMAGE_2 = registry.test.pensando.io:5000/node-labeller-partition:v7 +E2E_TEST_RUNNER_IMAGE = registry.test.pensando.io:5000/test-runner/test-runner:latest +E2E_AGFHC_TEST_RUNNER_IMAGE = registry.test.pensando.io:5000/test-runner:collab-agfhc +E2E_DCM_IMAGE = registry.test.pensando.io:5000/device-config-manager:v1 +E2E_KUBEVIRT_DEVICE_PLUGIN_IMAGE ?= registry.test.pensando.io:5000/k8s-device-plugin:kubevirt +E2E_KUBEVIRT_NODE_LABELLER_IMAGE ?= registry.test.pensando.io:5000/k8s-node-labeller:kubevirt + +E2E_KMM_TAG ?= e2e-gpuop-main +E2E_DRIVER_IMAGE_REPO ?= registry.test.pensando.io:5000/e2e +E2E_NODEAPP_IMG ?= registry.test.pensando.io:5000/nodeapp:dev +E2E_NODE_DIAG_IMAGE ?= registry.test.pensando.io:5000/busybox:1.36 +E2E_UTILS_CONTAINER_IMAGE ?= registry.test.pensando.io:5000/gpu-operator-utils:latest +E2E_ANR_CONFIGMAP_IMAGE ?= registry.test.pensando.io:5000/amd-gpu-operator-remediation-config-utils:latest diff --git a/docs-internal/knowledge/plans/2026-07-13-go-1.26.5-cve-remediation.md b/docs-internal/knowledge/plans/2026-07-13-go-1.26.5-cve-remediation.md new file mode 100644 index 000000000..4491032f0 --- /dev/null +++ b/docs-internal/knowledge/plans/2026-07-13-go-1.26.5-cve-remediation.md @@ -0,0 +1,61 @@ +# Bump Go 1.26.4 to 1.26.5 for CVE-2026-39822 + +- **Date:** 2026-07-13 +- **Author:** Nitish Bhat +- **Related PR(s):** #1599 +- **Related issue(s) / JIRA:** CVE-2026-39822 + +## Context + +Trivy scan on 2026-07-13 flagged CVE-2026-39822 (HIGH) in the operator's +`manager` binary. The vulnerability is in Go stdlib's `os.Root` — symlink +following allows directory traversal. Fixed in Go 1.26.5 (released +2026-07-07). + +The same scan also found 4 HIGH CVEs in the bundled `kubectl` binary +(golang.org/x/net v0.49.0) and 1 Go stdlib CVE. Those are upstream — +the kubectl binary is downloaded pre-built from `dl.k8s.io` and cannot +be patched by us. + +## Approach + +Bump Go from 1.26.4 to 1.26.5 in all five locations where the version +is referenced: + +| File | What changed | +|------|-------------| +| `go.mod` | `go 1.26.4` → `go 1.26.5` | +| `Dockerfile` | `ARG GOLANG_BASE_IMG` default | +| `Dockerfile.build` | Go tarball download URL | +| `Makefile` | `GOLANG_BASE_IMG` default, `DOCKER_BUILDER_TAG` v1.6 → v1.7 | +| `dev.env` | `GOLANG_BASE_IMG` pensando registry reference | + +Build container `gpu-operator-build:v1.7` rebuilt with Go 1.26.5 and +pushed to `registry.test.pensando.io:5000`. + +### Alternatives considered + +- Bump to Go 1.27rc2 — rejected; release candidate, not stable. +- Patch only `go.mod` — rejected; build container and CI would still + compile with Go 1.26.4, leaving the vulnerability in place. + +## Scope + +- **In scope:** Go version bump across all build files; build container + rebuild and push. +- **Out of scope:** kubectl CVEs (upstream); Go dependency bumps (no + dependency CVEs in manager binary). + +## Validation + +- `go build ./...` compiles cleanly with Go 1.26.5 +- `gpu-operator-build:v1.7` verified: `go version go1.26.5 linux/amd64` +- Trivy re-scan should show CVE-2026-39822 resolved in manager binary +- Sanity tests with new build container + +## Risks and rollback + +- **Known risks:** Minimal — Go 1.26.5 is a patch release with only + security fixes and bug fixes, no breaking changes. +- **Rollback plan:** Revert commit; build container v1.6 remains in + registry. diff --git a/go.mod b/go.mod index 0783006ee..fd3247e20 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/ROCm/gpu-operator -go 1.26.4 +go 1.26.5 require ( github.com/argoproj/argo-workflows/v4 v4.0.5 From 1fca2b466bb429f6cd0c49d03fdfb7d42cc51b5f Mon Sep 17 00:00:00 2001 From: Praveen Kumar Shanmugam <58961022+spraveenio@users.noreply.github.com> Date: Mon, 13 Jul 2026 20:45:55 -0700 Subject: [PATCH 2/3] Delete docs-internal/knowledge/plans/2026-07-13-go-1.26.5-cve-remediation.md --- .../2026-07-13-go-1.26.5-cve-remediation.md | 61 ------------------- 1 file changed, 61 deletions(-) delete mode 100644 docs-internal/knowledge/plans/2026-07-13-go-1.26.5-cve-remediation.md diff --git a/docs-internal/knowledge/plans/2026-07-13-go-1.26.5-cve-remediation.md b/docs-internal/knowledge/plans/2026-07-13-go-1.26.5-cve-remediation.md deleted file mode 100644 index 4491032f0..000000000 --- a/docs-internal/knowledge/plans/2026-07-13-go-1.26.5-cve-remediation.md +++ /dev/null @@ -1,61 +0,0 @@ -# Bump Go 1.26.4 to 1.26.5 for CVE-2026-39822 - -- **Date:** 2026-07-13 -- **Author:** Nitish Bhat -- **Related PR(s):** #1599 -- **Related issue(s) / JIRA:** CVE-2026-39822 - -## Context - -Trivy scan on 2026-07-13 flagged CVE-2026-39822 (HIGH) in the operator's -`manager` binary. The vulnerability is in Go stdlib's `os.Root` — symlink -following allows directory traversal. Fixed in Go 1.26.5 (released -2026-07-07). - -The same scan also found 4 HIGH CVEs in the bundled `kubectl` binary -(golang.org/x/net v0.49.0) and 1 Go stdlib CVE. Those are upstream — -the kubectl binary is downloaded pre-built from `dl.k8s.io` and cannot -be patched by us. - -## Approach - -Bump Go from 1.26.4 to 1.26.5 in all five locations where the version -is referenced: - -| File | What changed | -|------|-------------| -| `go.mod` | `go 1.26.4` → `go 1.26.5` | -| `Dockerfile` | `ARG GOLANG_BASE_IMG` default | -| `Dockerfile.build` | Go tarball download URL | -| `Makefile` | `GOLANG_BASE_IMG` default, `DOCKER_BUILDER_TAG` v1.6 → v1.7 | -| `dev.env` | `GOLANG_BASE_IMG` pensando registry reference | - -Build container `gpu-operator-build:v1.7` rebuilt with Go 1.26.5 and -pushed to `registry.test.pensando.io:5000`. - -### Alternatives considered - -- Bump to Go 1.27rc2 — rejected; release candidate, not stable. -- Patch only `go.mod` — rejected; build container and CI would still - compile with Go 1.26.4, leaving the vulnerability in place. - -## Scope - -- **In scope:** Go version bump across all build files; build container - rebuild and push. -- **Out of scope:** kubectl CVEs (upstream); Go dependency bumps (no - dependency CVEs in manager binary). - -## Validation - -- `go build ./...` compiles cleanly with Go 1.26.5 -- `gpu-operator-build:v1.7` verified: `go version go1.26.5 linux/amd64` -- Trivy re-scan should show CVE-2026-39822 resolved in manager binary -- Sanity tests with new build container - -## Risks and rollback - -- **Known risks:** Minimal — Go 1.26.5 is a patch release with only - security fixes and bug fixes, no breaking changes. -- **Rollback plan:** Revert commit; build container v1.6 remains in - registry. From 2c7e1f3de791701dfd50e5c778b9f97537fe9b2d Mon Sep 17 00:00:00 2001 From: Praveen Kumar Shanmugam <58961022+spraveenio@users.noreply.github.com> Date: Mon, 13 Jul 2026 20:46:15 -0700 Subject: [PATCH 3/3] Delete dev.env --- dev.env | 29 ----------------------------- 1 file changed, 29 deletions(-) delete mode 100644 dev.env diff --git a/dev.env b/dev.env deleted file mode 100644 index 72ad5780e..000000000 --- a/dev.env +++ /dev/null @@ -1,29 +0,0 @@ -GOFLAGS = "-mod=mod" -DOCKER_REGISTRY ?= registry.test.pensando.io:5000 -BUILD_BASE_IMG = registry.test.pensando.io:5000/ubuntu:22.04 -GOLANG_BASE_IMG = registry.test.pensando.io:5000/golang:1.26.5 -INSECURE_REGISTRY = registry.test.pensando.io:5000 - -E2E_INIT_CONTAINER_IMAGE = registry.test.pensando.io:5000/busybox:1.36 -E2E_KUBE_RBAC_PROXY_CURL_IMAGE = registry.test.pensando.io:5000/curl:7.78.0 -E2E_UBUNTU_BASE_IMAGE = registry.test.pensando.io:5000/ubuntu -E2E_MINIO_IMAGE = registry.test.pensando.io:5000/minio/minio:latest -E2E_EXPORTER_MOCK_IMAGE = registry.test.pensando.io:5000/device-metrics-exporter/exporter-mock:v1 -E2E_EXPORTER_MOCK_IMAGE_2 = registry.test.pensando.io:5000/device-metrics-exporter/exporter-mock:v2 -E2E_EXPORTER_IMAGE = registry.test.pensando.io:5000/device-metrics-exporter:latest -E2E_DEVICE_PLUGIN_IMAGE = registry.test.pensando.io:5000/device-plugin-partition:v8 -E2E_NODE_LABELLER_IMAGE = registry.test.pensando.io:5000/node-labeller-partition:v8 -E2E_DEVICE_PLUGIN_IMAGE_2 = registry.test.pensando.io:5000/device-plugin-partition:v7 -E2E_NODE_LABELLER_IMAGE_2 = registry.test.pensando.io:5000/node-labeller-partition:v7 -E2E_TEST_RUNNER_IMAGE = registry.test.pensando.io:5000/test-runner/test-runner:latest -E2E_AGFHC_TEST_RUNNER_IMAGE = registry.test.pensando.io:5000/test-runner:collab-agfhc -E2E_DCM_IMAGE = registry.test.pensando.io:5000/device-config-manager:v1 -E2E_KUBEVIRT_DEVICE_PLUGIN_IMAGE ?= registry.test.pensando.io:5000/k8s-device-plugin:kubevirt -E2E_KUBEVIRT_NODE_LABELLER_IMAGE ?= registry.test.pensando.io:5000/k8s-node-labeller:kubevirt - -E2E_KMM_TAG ?= e2e-gpuop-main -E2E_DRIVER_IMAGE_REPO ?= registry.test.pensando.io:5000/e2e -E2E_NODEAPP_IMG ?= registry.test.pensando.io:5000/nodeapp:dev -E2E_NODE_DIAG_IMAGE ?= registry.test.pensando.io:5000/busybox:1.36 -E2E_UTILS_CONTAINER_IMAGE ?= registry.test.pensando.io:5000/gpu-operator-utils:latest -E2E_ANR_CONFIGMAP_IMAGE ?= registry.test.pensando.io:5000/amd-gpu-operator-remediation-config-utils:latest