8000 SECURITY: microvm-rootfs: musl 1.2.6-r3 (CVE-2026-107891, regcomp overflows) by bryan-minimal · Pull Request #993 · gominimal/pkgs · GitHub
[go: up one dir, main page]
Skip to content

SECURITY: microvm-rootfs: musl 1.2.6-r3 (CVE-2026-107891, regcomp overflows) - #993

Merged
bryan-minimal merged 1 commit into
mainfrom
security-microvm-musl-r3
Oct 23, 2026
Merged

SECURITY: microvm-rootfs: musl 1.2.6-r3 (CVE-2026-107891, regcomp overflows)#993
bryan-minimal merged 1 commit into
mainfrom
security-microvm-musl-r3

Conversation

@bryan-minimal
@bryan-minimal bryan-minimal commented Oct 22, 2026 •
edited by coderabbitai Bot
Loading
Copy link
Copy Markdown
Member

CVE-2026-107891: integer overflows in musl's regcomp, in every musl from 0.5.0 through 1.2.6 (oss-security, 2026-10-21). A large or complex regular expression produces undersized heap allocations and then out-of-bounds heap writes: a crash at minimum, possibly code execution. Upstream's fix ships in 1.2.7, which is unreleased. Alpine carries the patch in musl 1.2.6-r3 (aports 3.24-stable main/musl, secfixes: 1.2.6-r3: CVE-2026-107891).

What changes

microvm-rootfs is the guest userland for the libkrun microVM, assembled from Alpine 3.24.1's minirootfs. That minirootfs ships musl and musl-utils 1.2.6-r2 on both arches, read from lib/apk/db/installed in our mirrored tarballs. This PR overlays musl-1.2.6-r3 and musl-utils-1.2.6-r3 from v3.24 main, using the existing security-override pattern (as for openssl and ca-certificates-bundle):

  • the overlay replaces lib/ld-musl-<arch>.so.1 (loader and libc in one), its libc.musl symlink, and the musl-utils binaries;
  • neither package has an install script;
  • build.sh's apk-db reconcile moves both recorded versions to 1.2.6-r3, so our component audit reads the patched version.

The comment in build.ncl says to drop both entries once alpine_release reaches a minirootfs carrying ≥ 1.2.6-r3.

Provenance of the pinned apks

For each arch (x86_64, aarch64) and package:

  • Index: the v3.24 main APKINDEX.tar.gz signature verifies against Alpine's keys from the minirootfs's /etc/apk/keys (…6165ee59 for x86_64, …616ae350 for aarch64).
  • Control checksum: each apk's control segment matches its APKINDEX C: checksum.
  • Package signature: each apk's own RSA signature verifies against the same key.
  • Mirror: uploaded to gs://minimal-staging-archives/alpine/v3.24/main/<arch>/, created no-clobber, and read back to the same sha256:
package aarch64 sha256 x86_64 sha256
musl-1.2.6-r3 2e178641…daed8a5 e142255d…789c21da
musl-utils-1.2.6-r3 bb460bdc…2fbaf49 47263d05…2de137ca

Verification

  • nickel format --check and bash -n pass, and MINIMAL_SCIENCE_MODE=1 mip dump --packages resolves the r3 apks on amd64 and arm64.
  • Remote session, aarch64, fresh activate, --rebuild: build.sh printed reconciled apk db: musl -> 1.2.6-r3 and musl-utils -> 1.2.6-r3 (superseded the base layer).
  • Reading the finished rootfs.img back with debugfs, via a temporary uncommitted probe in a separate freshly activated session:
    • the image's /lib/ld-musl-aarch64.so.1 hashes to 53282acc…cda11793, identical to the loader inside the r3 apk;
    • the base layer's r2 loader is 32377e6d…c4d4a44d;
    • the image's apk db reads musl 1.2.6-r3 and musl-utils 1.2.6-r3.
  • min check --packages microvm-rootfs: every check passes, standalone tests included, with no Skip.
  • amd64: the base layer's r2 loader is 38d022ce…9d72806 and r3's is 095b047c…dc630de5. CI's minimal build builds it.

Risk and scope

  • Who is exposed: a guest tool has to compile a regex from an untrusted source: busybox grep/sed/awk, bash =~, or git. Matching untrusted text against a trusted pattern isn't enough. The VM is the trust boundary, so this is guest hygiene rather than a host escape, but it's an out-of-bounds heap write in the guest's only libc, so it's worth closing now.
  • Other musl in the repo: the stage0-* bootstrap rungs (stage0-musl-1.1.24, -1.1.24-cc2, -1.2.5, and the musl-built tcc stages) build older musl. They're in the affected range, but they're build-only: no package declares them as a runtime dependency (checked against mip dump's runtime_deps). They only run during the toolchain bootstrap, on our own pinned sources, and patching them would rebuild the whole ladder. Not changed here.
  • Everything else in the repo is glibc.

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Chores
    • Updated the Alpine musl runtime packages to version 1.2.6-r3 for both supported architectures, with package records reflecting the updated versions.

@bryan-minimal @claude
SECURITY: microvm-rootfs: musl 1.2.6-r3 (CVE-2026-107891, regcomp ove…
651d98b 
…rflows)

Overlay Alpine v3.24 main's musl and musl-utils 1.2.6-r3 over the 3.24.1
minirootfs base layer's 1.2.6-r2. Every musl through 1.2.6 has the
regcomp integer overflows of CVE-2026-107891; Alpine's r3 carries the
fix. Same override pattern as openssl and ca-certificates-bundle: the
overlay replaces the files and build.sh reconciles the apk db.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@bryan-minimal
bryan-minimal requested a review from a team as a code owner October 22, 2026 21:09
@coderabbitai
coderabbitai Bot commented Oct 22, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
📥 Commits

Reviewing files that changed from the base of the PR and between befeac7 and 651d98b.

📒 Files selected for processing: 1
  • packages/microvm-rootfs/build.ncl

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

📝 Walkthrough

The build configuration adds pinned Alpine musl and musl-utils 1.2.6-r3 APK overrides for both supported architectures. It documents the files replaced, APK database version reconciliation, and when to remove the overrides.

Changes: Alpine musl package overrides

Layer / File(s) Summary
Pinned APK overrides
packages/microvm-rootfs/build.ncl		 Adds musl and musl-utils 1.2.6-r3 APKs with architecture-specific SHA-256 digests. Comments describe the replaced files, APK database version updates, and the release threshold for removing the overrides.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: norrietaylor

Merge Risk: ⚪ Minimal · up to 651d9

No actionable merge-blocking risk is identified from the reviewed change.

Pre-merge checks: Passed 5
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly identifies the security change: updating musl to 1.2.6-r3 in microvm-rootfs to address CVE-2026-107891.
Docstring Coverage Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR

Comment @coderabbitai help to get the list of available commands.

@bryan-minimal
bryan-minimal added this pull request to the merge queue Oct 23, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to no response for status checks Oct 23, 2026
@bryan-minimal
bryan-minimal added this pull request to the merge queue Oct 23, 2026
Merged via the queue into main with commit 079c106 Oct 23, 2026
11 checks passed
9F2E
@bryan-minimal
bryan-minimal deleted the security-microvm-musl-r3 branch October 23, 2026 03:35
This was referenced Oct 26, 2026
Merged
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@msample msample msample approved these changes
@norrietaylor norrietaylor norrietaylor approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@bryan-minimal @msample @norrietaylor
0