Skip to content

Commit

Permalink
Fix multiple CVE in Skopeo (#11007)
Browse files Browse the repository at this point in the history 
Co-authored-by: Sam Meluch <[email protected]>
Co-authored-by: jslobodzian <[email protected]>
  • Loading branch information
@xordux @sameluch @jslobodzian
3 people authored Jan 29, 2025
1 parent a18590b commit fc5507b
Show file tree
Hide file tree
Showing 3 changed files with 250 additions and 1 deletion.
62 changes: 62 additions & 0 deletions SPECS/skopeo/CVE-2023-45288.patch
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
From 224f3ac556af38fe8a2f719cdfe5752acfc276b6 Mon Sep 17 00:00:00 2001
From: Rohit Rawat <[email protected]>
Date: Sun, 10 Nov 2024 19:06:25 +0000
Subject: [PATCH] http2: close connections when receiving too many headers

Patch from https://go-review.googlesource.com/c/net/+/576057
---
vendor/golang.org/x/net/http2/frame.go | 31 ++++++++++++++++++++++++++
1 file changed, 31 insertions(+)

diff --git a/vendor/golang.org/x/net/http2/frame.go b/vendor/golang.org/x/net/http2/frame.go
index c1f6b90..175c154 100644
--- a/vendor/golang.org/x/net/http2/frame.go
+++ b/vendor/golang.org/x/net/http2/frame.go
@@ -1565,6 +1565,7 @@ func (fr *Framer) readMetaFrame(hf *HeadersFrame) (*MetaHeadersFrame, error) {
if size > remainSize {
hdec.SetEmitEnabled(false)
mh.Truncated = true
+ remainSize = 0
return
}
remainSize -= size
@@ -1577,6 +1578,36 @@ func (fr *Framer) readMetaFrame(hf *HeadersFrame) (*MetaHeadersFrame, error) {
var hc headersOrContinuation = hf
for {
frag := hc.HeaderBlockFragment()
+
+ // Avoid parsing large amounts of headers that we will then discard.
+ // If the sender exceeds the max header list size by too much,
+ // skip parsing the fragment and close the connection.
+ //
+ // "Too much" is either any CONTINUATION frame after we've already
+ // exceeded the max header list size (in which case remainSize is 0),
+ // or a frame whose encoded size is more than twice the remaining
+ // header list bytes we're willing to accept.
+ if int64(len(frag)) > int64(2*remainSize) {
+ if VerboseLogs {
+ log.Printf("http2: header list too large")
+ }
+ // It would be nice to send a RST_STREAM before sending the GOAWAY,
+ // but the struture of the server's frame writer makes this difficult.
+ return nil, ConnectionError(ErrCodeProtocol)
+ }
+
+ // Also close the connection after any CONTINUATION frame following an
+ // invalid header, since we stop tracking the size of the headers after
+ // an invalid one.
+ if invalid != nil {
+ if VerboseLogs {
+ log.Printf("http2: invalid header: %v", invalid)
+ }
+ // It would be nice to send a RST_STREAM before sending the GOAWAY,
+ // but the struture of the server's frame writer makes this difficult.
+ return nil, ConnectionError(ErrCodeProtocol)
+ }
+
if _, err := hdec.Write(frag); err != nil {
return nil, ConnectionError(ErrCodeCompression)
}
--
2.39.4

182 changes: 182 additions & 0 deletions SPECS/skopeo/CVE-2024-9676.patch
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,182 @@
From d461620d47450c72d9f0da215606949272df3398 Mon Sep 17 00:00:00 2001
From: Rohit Rawat <[email protected]>
Date: Sun, 10 Nov 2024 18:36:17 +0000
Subject: [PATCH] Backport CVE-2024-9676 fix

Patch from https://github.com/containers/storage/pull/2146 by Matt Heon <[email protected]>
---
.../github.com/containers/storage/.cirrus.yml | 2 +-
.../github.com/containers/storage/userns.go | 92 +++++++++++++------
.../containers/storage/userns_unsupported.go | 14 +++
3 files changed, 80 insertions(+), 28 deletions(-)
create mode 100644 vendor/github.com/containers/storage/userns_unsupported.go

diff --git a/vendor/github.com/containers/storage/.cirrus.yml b/vendor/github.com/containers/storage/.cirrus.yml
index c41dd5d..9e61509 100644
--- a/vendor/github.com/containers/storage/.cirrus.yml
+++ b/vendor/github.com/containers/storage/.cirrus.yml
@@ -119,7 +119,7 @@ lint_task:
env:
CIRRUS_WORKING_DIR: "/go/src/github.com/containers/storage"
container:
- image: golang
+ image: golang:1.19
modules_cache:
fingerprint_script: cat go.sum
folder: $GOPATH/pkg/mod
diff --git a/vendor/github.com/containers/storage/userns.go b/vendor/github.com/containers/storage/userns.go
index 32ae830..2c855da 100644
--- a/vendor/github.com/containers/storage/userns.go
+++ b/vendor/github.com/containers/storage/userns.go
@@ -1,18 +1,21 @@
+//go:build linux
+
package storage

import (
"fmt"
"os"
"os/user"
- "path/filepath"
"strconv"

drivers "github.com/containers/storage/drivers"
"github.com/containers/storage/pkg/idtools"
"github.com/containers/storage/pkg/unshare"
"github.com/containers/storage/types"
+ securejoin "github.com/cyphar/filepath-securejoin"
libcontainerUser "github.com/opencontainers/runc/libcontainer/user"
"github.com/sirupsen/logrus"
+ "golang.org/x/sys/unix"
)

// getAdditionalSubIDs looks up the additional IDs configured for
@@ -85,40 +88,59 @@ const nobodyUser = 65534
// parseMountedFiles returns the maximum UID and GID found in the /etc/passwd and
// /etc/group files.
func parseMountedFiles(containerMount, passwdFile, groupFile string) uint32 {
+ var (
+ passwd *os.File
+ group *os.File
+ size int
+ err error
+ )
if passwdFile == "" {
- passwdFile = filepath.Join(containerMount, "etc/passwd")
- }
- if groupFile == "" {
- groupFile = filepath.Join(groupFile, "etc/group")
+ passwd, err = secureOpen(containerMount, "/etc/passwd")
+ } else {
+ // User-specified override from a volume. Will not be in
+ // container root.
+ passwd, err = os.Open(passwdFile)
}
-
- size := 0
-
- users, err := libcontainerUser.ParsePasswdFile(passwdFile)
if err == nil {
- for _, u := range users {
- // Skip the "nobody" user otherwise we end up with 65536
- // ids with most images
- if u.Name == "nobody" {
- continue
- }
- if u.Uid > size && u.Uid != nobodyUser {
- size = u.Uid
- }
- if u.Gid > size && u.Gid != nobodyUser {
- size = u.Gid
+ defer passwd.Close()
+
+ users, err := libcontainerUser.ParsePasswd(passwd)
+ if err == nil {
+ for _, u := range users {
+ // Skip the "nobody" user otherwise we end up with 65536
+ // ids with most images
+ if u.Name == "nobody" || u.Name == "nogroup" {
+ continue
+ }
+ if u.Uid > size && u.Uid != nobodyUser {
+ size = u.Uid + 1
+ }
+ if u.Gid > size && u.Gid != nobodyUser {
+ size = u.Gid + 1
+ }
}
}
}

- groups, err := libcontainerUser.ParseGroupFile(groupFile)
+ if groupFile == "" {
+ group, err = secureOpen(containerMount, "/etc/group")
+ } else {
+ // User-specified override from a volume. Will not be in
+ // container root.
+ group, err = os.Open(groupFile)
+ }
if err == nil {
- for _, g := range groups {
- if g.Name == "nobody" {
- continue
- }
- if g.Gid > size && g.Gid != nobodyUser {
- size = g.Gid
+ defer group.Close()
+
+ groups, err := libcontainerUser.ParseGroup(group)
+ if err == nil {
+ for _, g := range groups {
+ if g.Name == "nobody" || g.Name == "nogroup" {
+ continue
+ }
+ if g.Gid > size && g.Gid != nobodyUser {
+ size = g.Gid + 1
+ }
}
}
}
@@ -309,3 +331,19 @@ func getAutoUserNSIDMappings(
gidMap := append(availableGIDs.zip(requestedContainerGIDs), additionalGIDMappings...)
return uidMap, gidMap, nil
}
+
+// Securely open (read-only) a file in a container mount.
+func secureOpen(containerMount, file string) (*os.File, error) {
+ filePath, err := securejoin.SecureJoin(containerMount, file)
+ if err != nil {
+ return nil, err
+ }
+
+ flags := unix.O_PATH | unix.O_CLOEXEC | unix.O_RDONLY
+ fileHandle, err := os.OpenFile(filePath, flags, 0)
+ if err != nil {
+ return nil, err
+ }
+
+ return fileHandle, nil
+}
diff --git a/vendor/github.com/containers/storage/userns_unsupported.go b/vendor/github.com/containers/storage/userns_unsupported.go
new file mode 100644
index 0000000..e37c18f
--- /dev/null
+++ b/vendor/github.com/containers/storage/userns_unsupported.go
@@ -0,0 +1,14 @@
+//go:build !linux
+
+package storage
+
+import (
+ "errors"
+
+ "github.com/containers/storage/pkg/idtools"
+ "github.com/containers/storage/types"
+)
+
+func (s *store) getAutoUserNS(_ *types.AutoUserNsOptions, _ *Image, _ rwLayerStore, _ []roLayerStore) ([]idtools.IDMap, []idtools.IDMap, error) {
+ return nil, nil, errors.New("user namespaces are not supported on this platform")
+}
--
2.39.4

7 changes: 6 additions & 1 deletion SPECS/skopeo/skopeo.spec
View file
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
Summary: Inspect container images and repositories on registries
Name: skopeo
Version: 1.14.4
Release: 2%{?dist}
Release: 3%{?dist}
License: Apache-2.0
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand All @@ -10,6 +10,8 @@ URL: https://github.com/containers/skopeo
Source0: https://github.com/containers/skopeo/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
Patch0: CVE-2022-2879.patch
Patch1: CVE-2024-6104.patch
Patch2: CVE-2023-45288.patch
Patch3: CVE-2024-9676.patch

%global debug_package %{nil}
%define our_gopath %{_topdir}/.gopath
Expand Down Expand Up @@ -49,6 +51,9 @@ make test-unit-local
%{_mandir}/man1/%%{name}*

%changelog
* Mon Nov 11 2024 Rohit Rawat <[email protected]> - 1.14.4-3
- Fix CVE-2023-45288 and CVE-2024-9676

* Fri Aug 02 2024 Sindhu Karri <[email protected]> - 1.14.4-2
- Fix CVE-2024-6104 in github.com/hashicorp/go-retryablehttp with a patch

Expand Down

0 comments on commit fc5507b

Please sign in to comment.