From d672d39d15e0c841447965b0b2f35d59ff9530ef Mon Sep 17 00:00:00 2001 From: praveen Date: Tue, 18 Aug 2026 05:28:07 -0700 Subject: [PATCH] sec-fix: bump Go toolchain 1.25.12 -> 1.25.13 to close stdlib CVEs trivy scan of the gpuctl binary flagged 7 HIGH stdlib CVEs, all fixed in go1.25.13: CVE-2026-33818, CVE-2026-39821, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862. Updated go.mod go directive, Makefile mod: target pin, and the Go download version in both build-container Dockerfiles (rhel9, ubu2204). No dependency version changes, so go.sum/vendor are unaffected. trivy scan of the rebuilt gpuctl binary reports zero findings. Co-authored-by: Claude --- sw/nic/gpuagent/Makefile | 2 +- sw/nic/gpuagent/go.mod | 2 +- tools/build-container/Dokerfile.rhel9 | 6 +++--- tools/build-container/Dokerfile.ubu2204 | 6 +++--- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/sw/nic/gpuagent/Makefile b/sw/nic/gpuagent/Makefile index 3ef0fd5a..a4b99d8c 100644 --- a/sw/nic/gpuagent/Makefile +++ b/sw/nic/gpuagent/Makefile @@ -176,7 +176,7 @@ $(TARGET)_gim: build-libs gogo-protos gen-protos $(OBJ_GIM) .PHONY: mod mod: @go mod tidy - @go mod edit -go=1.25.12 + @go mod edit -go=1.25.13 #CVE-2024-24790 - gpuctl @go mod edit -replace golang.org/x/net@v0.30.0=golang.org/x/net@v0.38.0 #CVE-2026-33186,GHSA-hrxh-6v49-42gf diff --git a/sw/nic/gpuagent/go.mod b/sw/nic/gpuagent/go.mod index a4fa5a7b..eff0b466 100644 --- a/sw/nic/gpuagent/go.mod +++ b/sw/nic/gpuagent/go.mod @@ -1,6 +1,6 @@ module github.com/ROCm/gpu-agent/sw/nic/gpuagent -go 1.25.12 +go 1.25.13 require ( github.com/gogo/protobuf v1.3.2 diff --git a/tools/build-container/Dokerfile.rhel9 b/tools/build-container/Dokerfile.rhel9 index 3258d995..df43eb65 100644 --- a/tools/build-container/Dokerfile.rhel9 +++ b/tools/build-container/Dokerfile.rhel9 @@ -28,9 +28,9 @@ RUN dnf install -y --allowerasing \ RUN yum install -y sudo -RUN wget https://go.dev/dl/go1.25.12.linux-amd64.tar.gz && \ - tar -C /usr/local -xzf go1.25.12.linux-amd64.tar.gz && \ - rm -f go1.25.12.linux-amd64.tar.gz +RUN wget https://go.dev/dl/go1.25.13.linux-amd64.tar.gz && \ + tar -C /usr/local -xzf go1.25.13.linux-amd64.tar.gz && \ + rm -f go1.25.13.linux-amd64.tar.gz ENV PATH=$PATH:/usr/local/go/bin:/root/go/bin ENV LD_LIBRARY_PATH=/usr/local/lib:$LD_LIBRARY_PATH diff --git a/tools/build-container/Dokerfile.ubu2204 b/tools/build-container/Dokerfile.ubu2204 index 6367964a..d1e486d8 100644 --- a/tools/build-container/Dokerfile.ubu2204 +++ b/tools/build-container/Dokerfile.ubu2204 @@ -30,9 +30,9 @@ RUN apt-get update && apt-get install -y \ WORKDIR /usr/src/github.com/Rocm/gpu-agent/ -RUN wget https://go.dev/dl/go1.25.12.linux-amd64.tar.gz && \ - tar -C /usr/local -xzf go1.25.12.linux-amd64.tar.gz && \ - rm -f go1.25.12.linux-amd64.tar.gz +RUN wget https://go.dev/dl/go1.25.13.linux-amd64.tar.gz && \ + tar -C /usr/local -xzf go1.25.13.linux-amd64.tar.gz && \ + rm -f go1.25.13.linux-amd64.tar.gz ADD ./entrypoint.sh /entrypoint.sh RUN chmod +x /entrypoint.sh