Skip to content

Upgrade cloud-hypervisor to v50.1 (CVE-2026-27211) #200

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ulziibay-kernel wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Upgrade cloud-hypervisor to v50.1 (CVE-2026-27211) #200

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9d977c0
Upgrade cloud-hypervisor to v50.1
ulziibay-kernel Apr 24, 2026
ceb572d
Regenerate VMM client from v50.1 spec; set image_type=Raw on disks
ulziibay-kernel Apr 27, 2026
6cb1e07
ci: rerun tests (network timeout flake on previous run)
ulziibay-kernel Apr 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 8 additions & 14 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,18 +37,12 @@ install-tools: $(OAPI_CODEGEN) $(AIR) $(WIRE) $(XCADDY)
# Download Cloud Hypervisor binaries
download-ch-binaries:
@echo "Downloading Cloud Hypervisor binaries..."
@mkdir -p lib/vmm/binaries/cloud-hypervisor/v48.0/{x86_64,aarch64}
@mkdir -p lib/vmm/binaries/cloud-hypervisor/v49.0/{x86_64,aarch64}
@echo "Downloading v48.0..."
@curl -L -o lib/vmm/binaries/cloud-hypervisor/v48.0/x86_64/cloud-hypervisor \
https://github.com/cloud-hypervisor/cloud-hypervisor/releases/download/v48.0/cloud-hypervisor-static
@curl -L -o lib/vmm/binaries/cloud-hypervisor/v48.0/aarch64/cloud-hypervisor \
https://github.com/cloud-hypervisor/cloud-hypervisor/releases/download/v48.0/cloud-hypervisor-static-aarch64
@echo "Downloading v49.0..."
@curl -L -o lib/vmm/binaries/cloud-hypervisor/v49.0/x86_64/cloud-hypervisor \
https://github.com/cloud-hypervisor/cloud-hypervisor/releases/download/v49.0/cloud-hypervisor-static
@curl -L -o lib/vmm/binaries/cloud-hypervisor/v49.0/aarch64/cloud-hypervisor \
https://github.com/cloud-hypervisor/cloud-hypervisor/releases/download/v49.0/cloud-hypervisor-static-aarch64
@mkdir -p lib/vmm/binaries/cloud-hypervisor/v50.1/{x86_64,aarch64}
@echo "Downloading v50.1..."
@curl -L -o lib/vmm/binaries/cloud-hypervisor/v50.1/x86_64/cloud-hypervisor \
https://github.com/cloud-hypervisor/cloud-hypervisor/releases/download/v50.1/cloud-hypervisor-static
@curl -L -o lib/vmm/binaries/cloud-hypervisor/v50.1/aarch64/cloud-hypervisor \
https://github.com/cloud-hypervisor/cloud-hypervisor/releases/download/v50.1/cloud-hypervisor-static-aarch64
@chmod +x lib/vmm/binaries/cloud-hypervisor/v*/*/cloud-hypervisor
@echo "Binaries downloaded successfully"

Expand Down Expand Up @@ -116,7 +110,7 @@ download-ch-spec:
@echo "Downloading Cloud Hypervisor API spec..."
@mkdir -p specs/cloud-hypervisor/api-v0.3.0
@curl -L -o specs/cloud-hypervisor/api-v0.3.0/cloud-hypervisor.yaml \
https://raw.githubusercontent.com/cloud-hypervisor/cloud-hypervisor/refs/tags/v48.0/vmm/src/api/openapi/cloud-hypervisor.yaml
https://raw.githubusercontent.com/cloud-hypervisor/cloud-hypervisor/refs/tags/v50.1/vmm/src/api/openapi/cloud-hypervisor.yaml
@echo "API spec downloaded"

# Generate Go code from OpenAPI spec
Expand Down Expand Up @@ -168,7 +162,7 @@ ensure-ch-binaries:
else \
echo "Unsupported architecture: $$ARCH"; exit 1; \
fi; \
if [ ! -f lib/vmm/binaries/cloud-hypervisor/v48.0/$$CH_ARCH/cloud-hypervisor ]; then \
if [ ! -f lib/vmm/binaries/cloud-hypervisor/v50.1/$$CH_ARCH/cloud-hypervisor ]; then \
echo "Cloud Hypervisor binaries not found, downloading..."; \
$(MAKE) download-ch-binaries; \
fi
Expand Down
3 changes: 2 additions & 1 deletion lib/hypervisor/cloudhypervisor/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,8 @@ func ToVMConfig(cfg hypervisor.VMConfig) vmm.VmConfig {
disks := make([]vmm.DiskConfig, 0, len(cfg.Disks))
for _, d := range cfg.Disks {
disk := vmm.DiskConfig{
Path: ptr(d.Path),
Path: ptr(d.Path),
ImageType: ptr(vmm.Raw),
}
if d.Readonly {
disk.Readonly = ptr(true)
Expand Down
2 changes: 1 addition & 1 deletion lib/hypervisor/cloudhypervisor/process.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ func (s *Starter) GetBinaryPath(p *paths.Paths, version string) (string, error)
// GetVersion returns the latest supported Cloud Hypervisor version.
// Cloud Hypervisor binaries are embedded, so we return the latest known version.
func (s *Starter) GetVersion(p *paths.Paths) (string, error) {
return string(vmm.V49_0), nil
return string(vmm.V50_1), nil
}

// StartVM launches Cloud Hypervisor, configures the VM, and boots it.
Expand Down
2 changes: 1 addition & 1 deletion lib/instances/manager_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1254,7 +1254,7 @@ func TestStorageOperations(t *testing.T) {
Env: map[string]string{"TEST": "value"},
CreatedAt: time.Now(),
HypervisorType: hypervisor.TypeCloudHypervisor,
HypervisorVersion: string(vmm.V49_0),
HypervisorVersion: string(vmm.V50_1),
SocketPath: "/tmp/test.sock",
DataDir: paths.New(tmpDir).InstanceDir("test-123"),
}
Expand Down
2 changes: 1 addition & 1 deletion lib/instances/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@ type StoredMetadata struct {

// Hypervisor configuration
HypervisorType hypervisor.Type // Hypervisor type (e.g., "cloud-hypervisor")
HypervisorVersion string // Hypervisor version (e.g., "v49.0")
HypervisorVersion string // Hypervisor version (e.g., "v50.1")
HypervisorPID *int // Hypervisor process ID (may be stale after host restart)

// Paths
Expand Down
4 changes: 2 additions & 2 deletions lib/system/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,8 +37,8 @@ Manages versioned kernel and initrd files for Cloud Hypervisor VMs.

**Snapshots require exact matches:**
```
Standby: kernel ch-6.12.8-kernel-1.2-20251213, CH v49.0
Restore: kernel ch-6.12.8-kernel-1.2-20251213, CH v49.0 (MUST match)
Standby: kernel ch-6.12.8-kernel-1.2-20251213, CH v50.1
Restore: kernel ch-6.12.8-kernel-1.2-20251213, CH v50.1 (MUST match)
```

**Maintenance upgrades (shutdown → boot):**
Expand Down
14 changes: 5 additions & 9 deletions lib/vmm/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ dataDir := "/var/lib/hypeman"
socketPath := "/tmp/vmm.sock"

// Start Cloud Hypervisor VMM (extracts binary if needed)
err := vmm.StartProcess(ctx, dataDir, vmm.V48_0, socketPath)
err := vmm.StartProcess(ctx, dataDir, vmm.V50_1, socketPath)
if err != nil {
log.Fatal(err)
}
Expand All @@ -60,9 +60,9 @@ resp, err := client.GetVmmPingWithResponse(ctx)
### Check Binary Version

```go
binaryPath, _ := vmm.GetBinaryPath(dataDir, vmm.V48_0)
binaryPath, _ := vmm.GetBinaryPath(dataDir, vmm.V50_1)
version, err := vmm.ParseVersion(binaryPath)
fmt.Println(version) // "v48.0"
fmt.Println(version) // "v50.1"
```

## Architecture
Expand All @@ -75,10 +75,7 @@ lib/vmm/
├── version.go # Version parsing utilities
├── binaries/ # Embedded Cloud Hypervisor binaries
│ └── cloud-hypervisor/
│ ├── v48.0/
│ │ ├── x86_64/cloud-hypervisor (4.5MB)
│ │ └── aarch64/cloud-hypervisor (3.3MB)
│ └── v49.0/
│ └── v50.1/
│ ├── x86_64/cloud-hypervisor (4.5MB)
│ └── aarch64/cloud-hypervisor (3.3MB)
| # There will be additional versions in the future...
Expand All @@ -87,8 +84,7 @@ lib/vmm/

## Supported Versions

- Cloud Hypervisor v48.0 (API v0.3.0)
- Cloud Hypervisor v49.0 (API v0.3.0)
- Cloud Hypervisor v50.1 (API v0.3.0)

There may be additional versions in the future. Cloud hypervisor versions may update frequently, while the API updates less frequently.

Expand Down
3 changes: 1 addition & 2 deletions lib/vmm/binaries_darwin.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,7 @@ import (
type CHVersion string

const (
V48_0 CHVersion = "v48.0"
V49_0 CHVersion = "v49.0"
V50_1 CHVersion = "v50.1"
)

// SupportedVersions lists supported Cloud Hypervisor versions.
Expand Down
11 changes: 4 additions & 7 deletions lib/vmm/binaries_linux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,20 +13,17 @@ import (
"github.com/kernel/hypeman/lib/paths"
)

//go:embed binaries/cloud-hypervisor/v48.0/x86_64/cloud-hypervisor
//go:embed binaries/cloud-hypervisor/v48.0/aarch64/cloud-hypervisor
//go:embed binaries/cloud-hypervisor/v49.0/x86_64/cloud-hypervisor
//go:embed binaries/cloud-hypervisor/v49.0/aarch64/cloud-hypervisor
//go:embed binaries/cloud-hypervisor/v50.1/x86_64/cloud-hypervisor
//go:embed binaries/cloud-hypervisor/v50.1/aarch64/cloud-hypervisor
var binaryFS embed.FS

type CHVersion string

const (
V48_0 CHVersion = "v48.0"
V49_0 CHVersion = "v49.0"
V50_1 CHVersion = "v50.1"
)

var SupportedVersions = []CHVersion{V48_0, V49_0}
var SupportedVersions = []CHVersion{V50_1}

// ExtractBinary extracts the embedded Cloud Hypervisor binary to the data directory
func ExtractBinary(p *paths.Paths, version CHVersion) (string, error) {
Expand Down
24 changes: 11 additions & 13 deletions lib/vmm/client_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,8 @@ import (
func TestExtractBinary(t *testing.T) {
tmpDir := t.TempDir()

// Test extraction for v48.0
binaryPath, err := ExtractBinary(paths.New(tmpDir), V48_0)
// Test extraction for v50.1
binaryPath, err := ExtractBinary(paths.New(tmpDir), V50_1)
require.NoError(t, err)

// Verify file exists
Expand All @@ -30,28 +30,27 @@ func TestExtractBinary(t *testing.T) {
assert.Equal(t, os.FileMode(0755), info.Mode().Perm())

// Test idempotency - second extraction should succeed and return same path
binaryPath2, err := ExtractBinary(paths.New(tmpDir), V48_0)
binaryPath2, err := ExtractBinary(paths.New(tmpDir), V50_1)
require.NoError(t, err)
assert.Equal(t, binaryPath, binaryPath2)
}

func TestIsVersionSupported(t *testing.T) {
assert.True(t, IsVersionSupported(V48_0))
assert.True(t, IsVersionSupported(V49_0))
assert.True(t, IsVersionSupported(V50_1))
assert.False(t, IsVersionSupported("v1.0"))
}

func TestParseVersion(t *testing.T) {
tmpDir := t.TempDir()

// Extract binary
binaryPath, err := ExtractBinary(paths.New(tmpDir), V48_0)
binaryPath, err := ExtractBinary(paths.New(tmpDir), V50_1)
require.NoError(t, err)

// Parse version
version, err := ParseVersion(binaryPath)
require.NoError(t, err)
assert.Equal(t, V48_0, version)
assert.Equal(t, V50_1, version)
}

func TestStartProcessAndShutdown(t *testing.T) {
Expand All @@ -60,7 +59,7 @@ func TestStartProcessAndShutdown(t *testing.T) {
ctx := context.Background()

// Start VMM process
pid, err := StartProcess(ctx, paths.New(tmpDir), V48_0, socketPath)
pid, err := StartProcess(ctx, paths.New(tmpDir), V50_1, socketPath)
require.NoError(t, err)
assert.Greater(t, pid, 0, "PID should be positive")

Expand Down Expand Up @@ -95,12 +94,12 @@ func TestStartProcessSocketInUse(t *testing.T) {
ctx := context.Background()

// Start first VMM
pid, err := StartProcess(ctx, paths.New(tmpDir), V48_0, socketPath)
pid, err := StartProcess(ctx, paths.New(tmpDir), V50_1, socketPath)
require.NoError(t, err)
assert.Greater(t, pid, 0)

// Try to start second VMM on same socket - should fail
_, err = StartProcess(ctx, paths.New(tmpDir), V48_0, socketPath)
_, err = StartProcess(ctx, paths.New(tmpDir), V50_1, socketPath)
require.Error(t, err)
assert.Contains(t, err.Error(), "socket already in use")

Expand All @@ -118,8 +117,7 @@ func TestMultipleVersions(t *testing.T) {
name string
version CHVersion
}{
{"v48.0", V48_0},
{"v49.0", V49_0},
{"v50.1", V50_1},
}

for _, tt := range tests {
Expand Down Expand Up @@ -159,7 +157,7 @@ func TestStartProcessCreatesLogFiles(t *testing.T) {
ctx := context.Background()

// Start VMM process with verbose logging to ensure output is written
pid, err := StartProcessWithArgs(ctx, paths.New(tmpDir), V48_0, socketPath, []string{"-v"})
pid, err := StartProcessWithArgs(ctx, paths.New(tmpDir), V50_1, socketPath, []string{"-v"})
require.NoError(t, err)
assert.Greater(t, pid, 0)

Expand Down
7 changes: 2 additions & 5 deletions lib/vmm/version.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,11 +20,8 @@ func ParseVersion(binaryPath string) (CHVersion, error) {
versionStr := strings.TrimSpace(string(output))

// Try to match known versions
if strings.Contains(versionStr, "v48.0") {
return V48_0, nil
}
if strings.Contains(versionStr, "v49.0") {
return V49_0, nil
if strings.Contains(versionStr, "v50.1") {
return V50_1, nil
Comment thread
ulziibay-kernel marked this conversation as resolved.
}

return "", fmt.Errorf("unsupported version: %s", versionStr)
Expand Down
Loading
Loading