[AUTO-CHERRYPICK] moby-cli: Add patch to resolve CVE-2023-45288 - branch main (#10237)
Co-authored-by: Sumynwa <sumsharma@microsoft.com>
This commit is contained in:
parent
b22d969705
commit
b216136dd4
|
@ -0,0 +1,83 @@
|
|||
From 63b4ddd633bde166d2b2800dbc6ad6a64f77b838 Mon Sep 17 00:00:00 2001
|
||||
From: Damien Neil <dneil@google.com>
|
||||
Date: Wed, 10 Jan 2024 13:41:39 -0800
|
||||
Subject: [PATCH] http2: close connections when receiving too many headers
|
||||
|
||||
Maintaining HPACK state requires that we parse and process
|
||||
all HEADERS and CONTINUATION frames on a connection.
|
||||
When a request's headers exceed MaxHeaderBytes, we don't
|
||||
allocate memory to store the excess headers but we do
|
||||
parse them. This permits an attacker to cause an HTTP/2
|
||||
endpoint to read arbitrary amounts of data, all associated
|
||||
with a request which is going to be rejected.
|
||||
|
||||
Set a limit on the amount of excess header frames we
|
||||
will process before closing a connection.
|
||||
|
||||
Thanks to Bartek Nowotarski for reporting this issue.
|
||||
|
||||
Fixes CVE-2023-45288
|
||||
Fixes golang/go#65051
|
||||
|
||||
Change-Id: I15df097268df13bb5a9e9d3a5c04a8a141d850f6
|
||||
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2130527
|
||||
Reviewed-by: Roland Shoemaker <bracewell@google.com>
|
||||
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
|
||||
Reviewed-on: https://go-review.googlesource.com/c/net/+/576155
|
||||
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
|
||||
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>
|
||||
Reviewed-by: Than McIntosh <thanm@google.com>
|
||||
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
|
||||
---
|
||||
vendor/golang.org/x/net/http2/frame.go | 31 ++++++++++++++++++++++++++
|
||||
1 file changed, 31 insertions(+)
|
||||
|
||||
diff --git a/vendor/golang.org/x/net/http2/frame.go b/vendor/golang.org/x/net/http2/frame.go
|
||||
index c1f6b90..175c154 100644
|
||||
--- a/vendor/golang.org/x/net/http2/frame.go
|
||||
+++ b/vendor/golang.org/x/net/http2/frame.go
|
||||
@@ -1565,6 +1565,7 @@ func (fr *Framer) readMetaFrame(hf *HeadersFrame) (*MetaHeadersFrame, error) {
|
||||
if size > remainSize {
|
||||
hdec.SetEmitEnabled(false)
|
||||
mh.Truncated = true
|
||||
+ remainSize = 0
|
||||
return
|
||||
}
|
||||
remainSize -= size
|
||||
@@ -1577,6 +1578,36 @@ func (fr *Framer) readMetaFrame(hf *HeadersFrame) (*MetaHeadersFrame, error) {
|
||||
var hc headersOrContinuation = hf
|
||||
for {
|
||||
frag := hc.HeaderBlockFragment()
|
||||
+
|
||||
+ // Avoid parsing large amounts of headers that we will then discard.
|
||||
+ // If the sender exceeds the max header list size by too much,
|
||||
+ // skip parsing the fragment and close the connection.
|
||||
+ //
|
||||
+ // "Too much" is either any CONTINUATION frame after we've already
|
||||
+ // exceeded the max header list size (in which case remainSize is 0),
|
||||
+ // or a frame whose encoded size is more than twice the remaining
|
||||
+ // header list bytes we're willing to accept.
|
||||
+ if int64(len(frag)) > int64(2*remainSize) {
|
||||
+ if VerboseLogs {
|
||||
+ log.Printf("http2: header list too large")
|
||||
+ }
|
||||
+ // It would be nice to send a RST_STREAM before sending the GOAWAY,
|
||||
+ // but the struture of the server's frame writer makes this difficult.
|
||||
+ return nil, ConnectionError(ErrCodeProtocol)
|
||||
+ }
|
||||
+
|
||||
+ // Also close the connection after any CONTINUATION frame following an
|
||||
+ // invalid header, since we stop tracking the size of the headers after
|
||||
+ // an invalid one.
|
||||
+ if invalid != nil {
|
||||
+ if VerboseLogs {
|
||||
+ log.Printf("http2: invalid header: %v", invalid)
|
||||
+ }
|
||||
+ // It would be nice to send a RST_STREAM before sending the GOAWAY,
|
||||
+ // but the struture of the server's frame writer makes this difficult.
|
||||
+ return nil, ConnectionError(ErrCodeProtocol)
|
||||
+ }
|
||||
+
|
||||
if _, err := hdec.Write(frag); err != nil {
|
||||
return nil, ConnectionError(ErrCodeCompression)
|
||||
}
|
|
@ -3,7 +3,7 @@
|
|||
Summary: The open-source application container engine client.
|
||||
Name: moby-cli
|
||||
Version: 24.0.9
|
||||
Release: 2%{?dist}
|
||||
Release: 3%{?dist}
|
||||
License: ASL 2.0
|
||||
Vendor: Microsoft Corporation
|
||||
Distribution: Azure Linux
|
||||
|
@ -12,6 +12,7 @@ URL: https://github.com/docker/cli
|
|||
Source0: https://github.com/docker/cli/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
|
||||
Source1: %{name}-%{version}-govendor-v1.tar.gz
|
||||
Patch0: disable_manpage_vendor.patch
|
||||
Patch1: CVE-2023-45288.patch
|
||||
BuildRequires: git
|
||||
BuildRequires: go-md2man
|
||||
BuildRequires: golang
|
||||
|
@ -77,6 +78,9 @@ install -p -m 644 contrib/completion/fish/docker.fish %{buildroot}%{_datadir}/fi
|
|||
%{_datadir}/fish/vendor_completions.d/docker.fish
|
||||
|
||||
%changelog
|
||||
* Thu Aug 22 2024 Sumedh Sharma <sumsharma@microsoft.com> - 24.0.9-3
|
||||
- Add patch to resolve CVE-2023-45288
|
||||
|
||||
* Thu Jun 06 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 24.0.9-2
|
||||
- Bump release to rebuild with go 1.21.11
|
||||
|
||||
|
|
Loading…
Reference in New Issue