Repin ADR 0008 verification bubblewrap to 0.12.0+ (GHSA-pxhw-h44j-8pfx / CVE-2026-87766) #80
Labels
No labels
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
Creatidy/creatidy-kernel#80
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Goal
Repin the ADR 0008 verification-only bubblewrap boundary from 0.11.0 to a maintained 0.12.0+ release that fixes GHSA-pxhw-h44j-8pfx / CVE-2026-87766, and re-run the full #50 native reception against the new pin.
Why
GHSA-pxhw-h44j-8pfx (CVE-2026-87766, published 2026-08-26, High/CVSS 8.8) affects all bubblewrap < 0.12.0. ADR 0008 pins exactly 0.11.0 (source
9ca3b05ec787acfb4b17bed37db5719fa777834f, tested binary SHA-256a75623409c0755c93ff5bba87ec4c407bf3dcb01d7b0d3c9802ee9a02a272e6f). The flaw is a setup-time path traversal: files/directories bubblewrap creates under the new root can follow a parent symlink into the host-side/oldrootmount, writing outside the sandbox as the invoking user. It is not a runtime sandbox escape and does not privilege-escalate the unprivileged fail-closed profile, so the accepted #50 reception is not known to be exploited; but the pinned version is inside the affected range and 0.12.0 (openat2RESOLVE_IN_ROOT, LGPL-2.1-or-later, setuid build removed) is the published remediation. Found during the bounded #78 research; recorded there, remediated here. 0.13.0 (2026-09-22) is the current release at the evidence cut.Scope
--lock-file/reaper-arming source-line evidence the ADR 0008 readiness gate depends on (the 0.11.0 line-specific indicators at 624/626/3598/3605 may have moved; the gate must be re-derived from the new pin, not assumed).make native-proof, 48 no-skip items) plusmake check,make package-check,make auditat the new pin; update ADR 0008 recorded hashes/versions and the reuse/licence record.Acceptance Criteria
Constraints
One ordinary issue branch from fetched canonical develop; one PR; no history rewrites. Do not weaken any #50 denial test, timeout, seccomp or namespace requirement to make 0.12.0+ pass; if the new release changes behavior, fix the verifier to the same-or-stronger guarantee and prove it natively. No host-global changes, privileged installation, or profile promotion beyond verification/test children. #78's research PR must not contain this remediation. Trusted-development remains non-isolated; #50 scope unchanged.
Links
docs/adr/0008-linux-bubblewrap-verification.md)Non-Goals
No worker/harness isolation promotion, no rootless OCI adoption decision, no #53 changes, no live execution or product GO.
#80 implementation complete: repinned to bubblewrap 0.13.0, native suite re-proven, review pending (ordinal 1/10)
Selected pin: v0.13.0 (current maintained release, 2026-09-22) — commit
719a4fd474d44b26906bcf2b1b0fb6eddd8d56d0, archive SHA-256e55bdb06f051664ecd3297d449a8b679b7cd1c73adb292b73a81d9b03c5fc462. Carries the GHSA-pxhw-h44j-8pfx / CVE-2026-87766 fix (openat2(RESOLVE_IN_ROOT)with fallback; host kernel 6.18 provides openat2) and refuses setuid execution outright. Licence is now LGPL-2.1-or-later (reuse record updated).Architecture unchanged: namespaces, capability drop, no-new-privileges, seccomp policy construction, mount/resource policy, authorization checks, readiness gating, parent-death/reaper and settlement semantics are untouched; only the pinned utility and its provenance moved. The readiness indicator was re-derived from the new source (do_init at bubblewrap.c:585; pdeath setup at 611 before filter install at 613; bootstrap branch 3533/3539), and the lock-before-arming ordering hazard remains covered by the existing forced-interval regressions, re-proven on the new binary.
Native evidence (new binary only; 0.11.0 receipts retained as history): two unprivileged builds of the pinned archive via the updated repository setup tool — tested
7c0da12c…, rebuild77a50609…(path variance, no reproducible claim) — each passed the complete native suite with zero skips (55 items), including canary/symlink/proc/FD/cap/NNP/seccomp/namespace/socket/mount/userns negatives, timeout/cancel/revocation/parent-death with setsid-descendant locks, and the pre-arming FIFO regressions.Gates:
uv sync --locked,make check(1397 tests + 81 subtests, 53 honest native skips),make package-check,make audit,git diff --check— all PASS.PR: #82 (open, unmerged; HEAD
da893c1d1dd8540f3570be9349a1d6812d6a439f, base19775b9679cf04f071e4fe5f2542fe230272ea36, 6 files +91/−43). Fresh independent whole-PR review reserved as ordinal 1/10. No displayed-version-only change; no guarantee weakened; no old receipt reused.Owner directive 2026-10-08T21:50:06Z explicitly continues invocation kernel-loop-20261008T204521Z and establishes required ordering: #80 BEFORE #79. Integrate existing PR #82 first, preserving branch, commits and review counter1/10; merge current develop normally, reconcile documentation, obtain fresh independent whole-PR review and exact-HEAD CI, then merge/verify/close #80. Rebuild full canonical queue afterwards and deliver #79 separately if eligible. Canonical counterpart: #79 comment15812. Its additional AC3 setup-time malicious-symlink/proc-magiclink no-canary-effect evidence stays separate and unchanged; #79 is not duplicate or completed by this repin. Existing HEAD
da893c1d1dand ordinal1 retained; old-base approval stale against develop3bcc650802de1f1beead9f8e5f579bb387c52573. No security weakening, host-global changes, live inference, main/release/deploy or product GO.Verified Integration And Acceptance
SAME invocation kernel-loop-20261008T204521Z, owner80-before79 order honored. PR #82 merged via supported nonforce merge-style MCP at2026-10-08T22:11:44Z, merge
cad1998d814479cefafe61fe1397fe88fded8b85, parents approvedbase3bcc650802de1f1beead9f8e5f579bb387c52573/ approvedHEAD6c4bce578d2197f87655bd915c4c70f33b11f964. Fresh canonical develop equals merge; both objects ancestors and all7 accepted paths byte-identical to reviewedHEAD. Originalda893c1+ ordinal1 preserved; normal developmergea6ce4b8 and docs6c4bce5, no rewrite.Review ordinal2/10 fresh independent GLM-5.3 wholePR APPROVE findings[]. Independently checked upstream exact archive/tag/license/advisory/source-specific reaper ordering and digest-matching native binary. Sanitized make check1405PASS71honestnativeSKIP81subtests; package-check/audit/diff-checkPASS; full patched native55PASS0SKIP, independently rerun and again integrated55PASS0SKIP. Exact-head CI2396 SUCCESS(run146); integrated develop CI2397 SUCCESS(run147): https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/147.
AC1 integrated0.13 exact source/archive/binary/libseccomp provenance and LGPL-2.1 record; no upstream redistribution, NOTICE unchanged. AC2 full native suite/pre-arming negatives zero-skip, re-derived585/611/613/3533/3539 source evidence. AC3 full repository gates/independent exact-current approval/currentCI. AC4 ADR advisory range/setup-time same-privilege/profile-mitigation/history analysis retained. Current whole-worker document reconciled to0.13 without relabelling old receipts.
#79 stays OPEN and separate with full additional acceptance, especially setup-time malicious-symlink/proc-magiclink host-canary absence; none claimed by this closure. #53 AC4 remains incomplete. No namespace/seccomp/authority/settlement weakening, host-global changes, live inference, main/release/deploy/product GO.