From dd6aec6707bc0833e49a25bf5eef7fc0e3cdaa9e Mon Sep 17 00:00:00 2001 From: bwzhang Date: Sun, 7 Apr 2024 16:11:34 +0800 Subject: [PATCH] fix CVE-2023-39325 --- 0001-fix-CVE-2023-39325.patch | 197 ++++++++++++++++++++++++++++++++++ cri-tools.spec | 11 +- 2 files changed, 207 insertions(+), 1 deletion(-) create mode 100644 0001-fix-CVE-2023-39325.patch diff --git a/0001-fix-CVE-2023-39325.patch b/0001-fix-CVE-2023-39325.patch new file mode 100644 index 0000000..194ac6e --- /dev/null +++ b/0001-fix-CVE-2023-39325.patch @@ -0,0 +1,197 @@ +From 12296da9c423334046da42da52b0cc9a4f5cb32c Mon Sep 17 00:00:00 2001 +From: bwzhang +Date: Wed, 3 Apr 2024 11:40:04 +0800 +Subject: [PATCH] fix CVE-2023-39325 + +http2: limit maximum handler goroutines to MaxConcurrentStreams + +When the peer opens a new stream while we have MaxConcurrentStreams +handler goroutines running, defer starting a handler until one +of the existing handlers exits. + +Fixes golang/go#63417 +Fixes CVE-2023-39325 + +Change-Id: If0531e177b125700f3e24c5ebd24b1023098fa6d +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2045854 +TryBot-Result: Security TryBots +Reviewed-by: Ian Cottrell +Reviewed-by: Tatiana Bradley +Run-TryBot: Damien Neil +Reviewed-on: https://go-review.googlesource.com/c/net/+/534215 +Reviewed-by: Michael Pratt +Reviewed-by: Dmitri Shuralyov +LUCI-TryBot-Result: Go LUCI +Auto-Submit: Dmitri Shuralyov int(4*sc.advMaxStreams) { ++ return sc.countError("too_many_early_resets", ConnectionError(ErrCodeEnhanceYourCalm)) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + func checkPriority(streamID uint32, p PriorityParam) error { + if streamID == p.StreamDep { + // Section 5.3.1: "A stream cannot depend on itself. An endpoint MUST treat +@@ -2139,6 +2202,7 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r + + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +@@ -2901,6 +2965,7 @@ func (sc *serverConn) startPush(msg *startPushRequest) { + panic(fmt.Sprintf("newWriterAndRequestNoBody(%+v): %v", msg.url, err)) + } + ++ sc.curHandlers++ + go sc.runHandler(rw, req, sc.handler.ServeHTTP) + return promisedID, nil + } +@@ -2980,3 +3045,32 @@ func h1ServerKeepAlivesDisabled(hs *http.Server) bool { + } + return false + } ++ ++func (sc *serverConn) countError(name string, err error) error { ++ if sc == nil || sc.srv == nil { ++ return err ++ } ++ f := sc.srv.CountError ++ if f == nil { ++ return err ++ } ++ var typ string ++ var code ErrCode ++ switch e := err.(type) { ++ case ConnectionError: ++ typ = "conn" ++ code = ErrCode(e) ++ case StreamError: ++ typ = "stream" ++ code = ErrCode(e.Code) ++ default: ++ return err ++ } ++ codeStr := errCodeName[code] ++ if codeStr == "" { ++ codeStr = strconv.Itoa(int(code)) ++ } ++ f(fmt.Sprintf("%s_%s_%s", typ, codeStr, name)) ++ return err ++} ++ +-- +2.20.1 + diff --git a/cri-tools.spec b/cri-tools.spec index 995583e..0dec473 100644 --- a/cri-tools.spec +++ b/cri-tools.spec @@ -13,12 +13,15 @@ Name: cri-tools Version: 1.22.0 -Release: 2 +Release: 3 Summary: CLI and validation tools for Container Runtime Interface License: ASL 2.0 URL: https://%{goipath} Source0: %{url}/archive/v%{version}/%{name}-%{version}.tar.gz Source1: https://github.com/cpuguy83/go-md2man/archive/v1.0.10.tar.gz + +Patch0001: 0001-fix-CVE-2023-39325.patch + ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm} ppc64le s390x} BuildRequires: golang, glibc-static, git Provides: crictl = %{version}-%{release} @@ -59,6 +62,12 @@ install -p -m 644 docs/crictl.1 %{buildroot}%{_mandir}/man1 %{_mandir}/man1/crictl* %changelog +* Sun Apr 07 2024 zhangbowei - 1.22.0-3 +- Type:bugfix +- CVE:NA +- SUG:NA +- DESC: fix CVE-2023-39325 + * Tue Jun 07 2022 fushanqing - 1.22.0-2 - update Source0