From 4b1c9ac9750db6c007935a4cd3d65d88bd8a733b Mon Sep 17 00:00:00 2001 From: zhongjiawei Date: Tue, 30 Jan 2024 14:29:10 +0800 Subject: [PATCH] containerd: fix CVE-2023-39325 (cherry picked from commit 7e7607cc8e11da0a66bd82a997f2064ee1f3b166) --- containerd.spec | 8 +- git-commit | 2 +- ...ort-net-http-regenerate-h2_bundle.go.patch | 147 ++++++++++++++++++ series.conf | 1 + 4 files changed, 156 insertions(+), 2 deletions(-) create mode 100644 patch/0109-containerd-Backport-net-http-regenerate-h2_bundle.go.patch diff --git a/containerd.spec b/containerd.spec index a9d4deb..16ef5a4 100644 --- a/containerd.spec +++ b/containerd.spec @@ -2,7 +2,7 @@ %global debug_package %{nil} Version: 1.2.0 Name: containerd -Release: 315 +Release: 316 Summary: An industry-standard container runtime License: ASL 2.0 URL: https://containerd.io @@ -72,6 +72,12 @@ install -p -m 755 bin/ctr $RPM_BUILD_ROOT/%{_bindir}/ctr %{_bindir}/ctr %changelog +* Tue Jan 30 2024 zhongjiawei - 1.2.0-316 +- Type:CVE +- ID:NA +- SUG:NA +- DESC:fix CVE-2023-39325 + * Thu Dec 21 2023 zhongjiawei - 1.2.0-315 - Type:bugfix - ID:NA diff --git a/git-commit b/git-commit index b06b9a9..86988da 100644 --- a/git-commit +++ b/git-commit @@ -1 +1 @@ -b57240907ae3e0f3f5251b6f28463ad61976baf4 +3f8608f668f99748bd26d8369aa167e0e6b9f855 diff --git a/patch/0109-containerd-Backport-net-http-regenerate-h2_bundle.go.patch b/patch/0109-containerd-Backport-net-http-regenerate-h2_bundle.go.patch new file mode 100644 index 0000000..e81ee79 --- /dev/null +++ b/patch/0109-containerd-Backport-net-http-regenerate-h2_bundle.go.patch @@ -0,0 +1,147 @@ +From 6dc693737f84785a30238ca7640ad8ba605c0eac Mon Sep 17 00:00:00 2001 +From: Damien Neil +Date: Sat, 7 Oct 2023 05:16:27 +0800 +Subject: [PATCH] [Backport] net/http: regenerate h2_bundle.go + +Offering: Cloud Core Network +CVE: CVE-2023-39325 +Reference: https://go-review.googlesource.com/c/go/+/534255 + +Pull in a security fix from x/net/http2: +http2: limit maximum handler goroutines to MaxConcurrentStreamso + +Note: The upstream does not submit this change to go1.17 according to the rules of MinorReleases. +Corego3.x are based on go1.17.8. Therefore, it need to submit the change to corego3.x. + +Edited-by: machangwang m00509938 + +For #63417 +Fixes #63426 +Fixes CVE-2023-39325 + +Change-Id: I6e32397323cd9b4114c990fcc9d19557a7f5f619 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2047401 +Reviewed-by: Tatiana Bradley +TryBot-Result: Security TryBots +Run-TryBot: Damien Neil +Reviewed-by: Ian Cottrell +Reviewed-on: https://go-review.googlesource.com/c/go/+/534255 +Reviewed-by: Dmitri Shuralyov +Reviewed-by: Damien Neil +TryBot-Bypass: Dmitri Shuralyov +Reviewed-by: Michael Pratt +Auto-Submit: Dmitri Shuralyov +Signed-off-by: Ma Chang Wang machangwang@huawei.com +--- + vendor/golang.org/x/net/http2/server.go | 62 ++++++++++++++++++++++++- + 1 file changed, 60 insertions(+), 2 deletions(-) + +diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go +index eae143d..fb18ae7 100644 +--- a/vendor/golang.org/x/net/http2/server.go ++++ b/vendor/golang.org/x/net/http2/server.go +@@ -470,9 +470,11 @@ type serverConn struct { + advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client + curClientStreams uint32 // number of open streams initiated by the client + curPushedStreams uint32 // number of open streams initiated by server push ++ curHandlers uint32 // number of running handler goroutines + maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests + maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes + streams map[uint32]*stream ++ unstartedHandlers []unstartedHandler + initialStreamSendWindowSize int32 + maxFrameSize int32 + headerTableSize uint32 +@@ -843,6 +845,8 @@ func (sc *serverConn) serve() { + return + case gracefulShutdownMsg: + sc.startGracefulShutdownInternal() ++ case handlerDoneMsg: ++ sc.handlerDone() + default: + panic("unknown timer") + } +@@ -875,6 +879,7 @@ var ( + idleTimerMsg = new(serverMessage) + shutdownTimerMsg = new(serverMessage) + gracefulShutdownMsg = new(serverMessage) ++ handlerDoneMsg = new(serverMessage) + ) + + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } +@@ -1784,8 +1789,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + sc.conn.SetReadDeadline(time.Time{}) + } + +- go sc.runHandler(rw, req, handler) +- return nil ++ return sc.scheduleHandler(id, rw, req, handler) + } + + func (st *stream) processTrailerHeaders(f *MetaHeadersFrame) error { +@@ -2028,8 +2032,62 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r + return rw, req, nil + } + ++type unstartedHandler struct { ++ streamID uint32 ++ rw *responseWriter ++ req *http.Request ++ handler func(http.ResponseWriter, *http.Request) ++} ++ ++// scheduleHandler starts a handler goroutine, ++// or schedules one to start as soon as an existing handler finishes. ++func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error { ++ sc.serveG.check() ++ maxHandlers := sc.advMaxStreams ++ if sc.curHandlers < maxHandlers { ++ sc.curHandlers++ ++ go sc.runHandler(rw, req, handler) ++ return nil ++ } ++ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) { ++ return ConnectionError(ErrCodeEnhanceYourCalm) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +-- +2.33.0 + diff --git a/series.conf b/series.conf index 31dcc14..ab09664 100644 --- a/series.conf +++ b/series.conf @@ -116,4 +116,5 @@ sw64_patch/3000-bbolt-add-support-sw_64.patch patch/0106-containerd-bump-ttrpc.patch patch/0107-containerd-Fix-missing-closed-fifo.patch patch/0108-containerd-Update-TTRPC-and-Protobuild-dependencies.patch +patch/0109-containerd-Backport-net-http-regenerate-h2_bundle.go.patch # end -- Gitee