[AUTO-CHERRYPICK] moby-cli: Add patch to resolve CVE-2023-45288 - branch main (#10237)
Co-authored-by: Sumynwa <sumsharma@microsoft.com>
This commit is contained in:
parent
b22d969705
commit
b216136dd4
|
@ -0,0 +1,83 @@
|
||||||
|
From 63b4ddd633bde166d2b2800dbc6ad6a64f77b838 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Damien Neil <dneil@google.com>
|
||||||
|
Date: Wed, 10 Jan 2024 13:41:39 -0800
|
||||||
|
Subject: [PATCH] http2: close connections when receiving too many headers
|
||||||
|
|
||||||
|
Maintaining HPACK state requires that we parse and process
|
||||||
|
all HEADERS and CONTINUATION frames on a connection.
|
||||||
|
When a request's headers exceed MaxHeaderBytes, we don't
|
||||||
|
allocate memory to store the excess headers but we do
|
||||||
|
parse them. This permits an attacker to cause an HTTP/2
|
||||||
|
endpoint to read arbitrary amounts of data, all associated
|
||||||
|
with a request which is going to be rejected.
|
||||||
|
|
||||||
|
Set a limit on the amount of excess header frames we
|
||||||
|
will process before closing a connection.
|
||||||
|
|
||||||
|
Thanks to Bartek Nowotarski for reporting this issue.
|
||||||
|
|
||||||
|
Fixes CVE-2023-45288
|
||||||
|
Fixes golang/go#65051
|
||||||
|
|
||||||
|
Change-Id: I15df097268df13bb5a9e9d3a5c04a8a141d850f6
|
||||||
|
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2130527
|
||||||
|
Reviewed-by: Roland Shoemaker <bracewell@google.com>
|
||||||
|
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
|
||||||
|
Reviewed-on: https://go-review.googlesource.com/c/net/+/576155
|
||||||
|
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
|
||||||
|
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>
|
||||||
|
Reviewed-by: Than McIntosh <thanm@google.com>
|
||||||
|
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
|
||||||
|
---
|
||||||
|
vendor/golang.org/x/net/http2/frame.go | 31 ++++++++++++++++++++++++++
|
||||||
|
1 file changed, 31 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/vendor/golang.org/x/net/http2/frame.go b/vendor/golang.org/x/net/http2/frame.go
|
||||||
|
index c1f6b90..175c154 100644
|
||||||
|
--- a/vendor/golang.org/x/net/http2/frame.go
|
||||||
|
+++ b/vendor/golang.org/x/net/http2/frame.go
|
||||||
|
@@ -1565,6 +1565,7 @@ func (fr *Framer) readMetaFrame(hf *HeadersFrame) (*MetaHeadersFrame, error) {
|
||||||
|
if size > remainSize {
|
||||||
|
hdec.SetEmitEnabled(false)
|
||||||
|
mh.Truncated = true
|
||||||
|
+ remainSize = 0
|
||||||
|
return
|
||||||
|
}
|
||||||
|
remainSize -= size
|
||||||
|
@@ -1577,6 +1578,36 @@ func (fr *Framer) readMetaFrame(hf *HeadersFrame) (*MetaHeadersFrame, error) {
|
||||||
|
var hc headersOrContinuation = hf
|
||||||
|
for {
|
||||||
|
frag := hc.HeaderBlockFragment()
|
||||||
|
+
|
||||||
|
+ // Avoid parsing large amounts of headers that we will then discard.
|
||||||
|
+ // If the sender exceeds the max header list size by too much,
|
||||||
|
+ // skip parsing the fragment and close the connection.
|
||||||
|
+ //
|
||||||
|
+ // "Too much" is either any CONTINUATION frame after we've already
|
||||||
|
+ // exceeded the max header list size (in which case remainSize is 0),
|
||||||
|
+ // or a frame whose encoded size is more than twice the remaining
|
||||||
|
+ // header list bytes we're willing to accept.
|
||||||
|
+ if int64(len(frag)) > int64(2*remainSize) {
|
||||||
|
+ if VerboseLogs {
|
||||||
|
+ log.Printf("http2: header list too large")
|
||||||
|
+ }
|
||||||
|
+ // It would be nice to send a RST_STREAM before sending the GOAWAY,
|
||||||
|
+ // but the struture of the server's frame writer makes this difficult.
|
||||||
|
+ return nil, ConnectionError(ErrCodeProtocol)
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ // Also close the connection after any CONTINUATION frame following an
|
||||||
|
+ // invalid header, since we stop tracking the size of the headers after
|
||||||
|
+ // an invalid one.
|
||||||
|
+ if invalid != nil {
|
||||||
|
+ if VerboseLogs {
|
||||||
|
+ log.Printf("http2: invalid header: %v", invalid)
|
||||||
|
+ }
|
||||||
|
+ // It would be nice to send a RST_STREAM before sending the GOAWAY,
|
||||||
|
+ // but the struture of the server's frame writer makes this difficult.
|
||||||
|
+ return nil, ConnectionError(ErrCodeProtocol)
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
if _, err := hdec.Write(frag); err != nil {
|
||||||
|
return nil, ConnectionError(ErrCodeCompression)
|
||||||
|
}
|
|
@ -3,7 +3,7 @@
|
||||||
Summary: The open-source application container engine client.
|
Summary: The open-source application container engine client.
|
||||||
Name: moby-cli
|
Name: moby-cli
|
||||||
Version: 24.0.9
|
Version: 24.0.9
|
||||||
Release: 2%{?dist}
|
Release: 3%{?dist}
|
||||||
License: ASL 2.0
|
License: ASL 2.0
|
||||||
Vendor: Microsoft Corporation
|
Vendor: Microsoft Corporation
|
||||||
Distribution: Azure Linux
|
Distribution: Azure Linux
|
||||||
|
@ -12,6 +12,7 @@ URL: https://github.com/docker/cli
|
||||||
Source0: https://github.com/docker/cli/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
|
Source0: https://github.com/docker/cli/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
|
||||||
Source1: %{name}-%{version}-govendor-v1.tar.gz
|
Source1: %{name}-%{version}-govendor-v1.tar.gz
|
||||||
Patch0: disable_manpage_vendor.patch
|
Patch0: disable_manpage_vendor.patch
|
||||||
|
Patch1: CVE-2023-45288.patch
|
||||||
BuildRequires: git
|
BuildRequires: git
|
||||||
BuildRequires: go-md2man
|
BuildRequires: go-md2man
|
||||||
BuildRequires: golang
|
BuildRequires: golang
|
||||||
|
@ -77,6 +78,9 @@ install -p -m 644 contrib/completion/fish/docker.fish %{buildroot}%{_datadir}/fi
|
||||||
%{_datadir}/fish/vendor_completions.d/docker.fish
|
%{_datadir}/fish/vendor_completions.d/docker.fish
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Thu Aug 22 2024 Sumedh Sharma <sumsharma@microsoft.com> - 24.0.9-3
|
||||||
|
- Add patch to resolve CVE-2023-45288
|
||||||
|
|
||||||
* Thu Jun 06 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 24.0.9-2
|
* Thu Jun 06 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 24.0.9-2
|
||||||
- Bump release to rebuild with go 1.21.11
|
- Bump release to rebuild with go 1.21.11
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue