Skip to content

Commit 30f1ce2

Browse files
bfjeldsbfjelds
authored
Address CVE-2024-3727 by patching vendored github.com/containers/image (#9343)
1 parent ddbdd89 commit 30f1ce2

2 files changed

Lines changed: 170 additions & 1 deletion

File tree

‎SPECS/containerized-data-importer/CVE-2024-3727.patch‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
From ea14d57b98cc37decad0c39ccbafb27994274b47 Mon Sep 17 00:00:00 2001
2+
From: Brian Fjeldstad <bfjelds@microsoft.com>
3+
Date: Thu, 6 Jun 2024 21:13:36 +0000
4+
Subject: [PATCH] apply CVE-2024-3727 fix to v5.19.1
5+
6+
---
7+
vendor/github.com/containers/image/v5/docker/docker_client.go | 3 +++
8+
vendor/github.com/containers/image/v5/docker/docker_image.go | 8 ++++++--
9+
vendor/github.com/containers/image/v5/docker/docker_image_dest.go | 15 ++++++++++++---
10+
vendor/github.com/containers/image/v5/docker/docker_image_src.go | 19 +++++++++++++++++--
11+
vendor/github.com/containers/image/v5/docker/lookaside.go | 7 +++++--
12+
5 files changed, 43 insertions(+), 9 deletions(-)
13+
14+
diff --git a/vendor/github.com/containers/image/v5/docker/docker_client.go b/vendor/github.com/containers/image/v5/docker/docker_client.go
15+
index 833323b4..99bde923 100644
16+
--- a/vendor/github.com/containers/image/v5/docker/docker_client.go
17+
+++ b/vendor/github.com/containers/image/v5/docker/docker_client.go
18+
@@ -796,6 +796,9 @@ func (c *dockerClient) detectProperties(ctx context.Context) error {
19+
// getExtensionsSignatures returns signatures from the X-Registry-Supports-Signatures API extension,
20+
// using the original data structures.
21+
func (c *dockerClient) getExtensionsSignatures(ctx context.Context, ref dockerReference, manifestDigest digest.Digest) (*extensionSignatureList, error) {
22+
+ if err := manifestDigest.Validate(); err != nil { // Make sure manifestDigest.String() does not contain any unexpected characters
23+
+ return nil, err
24+
+ }
25+
path := fmt.Sprintf(extensionsSignaturePath, reference.Path(ref.ref), manifestDigest)
26+
res, err := c.makeRequest(ctx, http.MethodGet, path, nil, nil, v2Auth, nil)
27+
if err != nil {
28+
diff --git a/vendor/github.com/containers/image/v5/docker/docker_image.go b/vendor/github.com/containers/image/v5/docker/docker_image.go
29+
index c84bb37d..0076d229 100644
30+
--- a/vendor/github.com/containers/image/v5/docker/docker_image.go
31+
+++ b/vendor/github.com/containers/image/v5/docker/docker_image.go
32+
@@ -83,8 +83,12 @@ func GetRepositoryTags(ctx context.Context, sys *types.SystemContext, ref types.
33+
if err = json.NewDecoder(res.Body).Decode(&tagsHolder); err != nil {
34+
return nil, err
35+
}
36+
- tags = append(tags, tagsHolder.Tags...)
37+
-
38+
+ for _, tag := range tagsHolder.Tags {
39+
+ if _, err := reference.WithTag(dr.ref, tag); err != nil { // Ensure the tag does not contain unexpected values
40+
+ return nil, fmt.Errorf("registry returned invalid tag %q: %w", tag, err)
41+
+ }
42+
+ tags = append(tags, tag)
43+
+ }
44+
link := res.Header.Get("Link")
45+
if link == "" {
46+
break
47+
diff --git a/vendor/github.com/containers/image/v5/docker/docker_image_dest.go b/vendor/github.com/containers/image/v5/docker/docker_image_dest.go
48+
index e7af8f93..1096c56f 100644
49+
--- a/vendor/github.com/containers/image/v5/docker/docker_image_dest.go
50+
+++ b/vendor/github.com/containers/image/v5/docker/docker_image_dest.go
51+
@@ -226,6 +226,9 @@ func (d *dockerImageDestination) PutBlob(ctx context.Context, stream io.Reader,
52+
// If the destination does not contain the blob, or it is unknown, blobExists ordinarily returns (false, -1, nil);
53+
// it returns a non-nil error only on an unexpected failure.
54+
func (d *dockerImageDestination) blobExists(ctx context.Context, repo reference.Named, digest digest.Digest, extraScope *authScope) (bool, int64, error) {
55+
+ if err := digest.Validate(); err != nil { // Make sure digest.String() does not contain any unexpected characters
56+
+ return false, -1, err
57+
+ }
58+
checkPath := fmt.Sprintf(blobsPath, reference.Path(repo), digest.String())
59+
logrus.Debugf("Checking %s", checkPath)
60+
res, err := d.c.makeRequest(ctx, http.MethodHead, checkPath, nil, nil, v2Auth, extraScope)
61+
@@ -558,8 +561,11 @@ func (d *dockerImageDestination) putSignaturesToLookaside(signatures [][]byte, m
62+
63+
// NOTE: Keep this in sync with docs/signature-protocols.md!
64+
for i, signature := range signatures {
65+
- url := signatureStorageURL(d.c.signatureBase, manifestDigest, i)
66+
- err := d.putOneSignature(url, signature)
67+
+ url, err := signatureStorageURL(d.c.signatureBase, manifestDigest, i)
68+
+ if err != nil {
69+
+ return err
70+
+ }
71+
+ err = d.putOneSignature(url, signature)
72+
if err != nil {
73+
return err
74+
}
75+
@@ -570,7 +576,10 @@ func (d *dockerImageDestination) putSignaturesToLookaside(signatures [][]byte, m
76+
// is enough for dockerImageSource to stop looking for other signatures, so that
77+
// is sufficient.
78+
for i := len(signatures); ; i++ {
79+
- url := signatureStorageURL(d.c.signatureBase, manifestDigest, i)
80+
+ url, err := signatureStorageURL(d.c.signatureBase, manifestDigest, i)
81+
+ if err != nil {
82+
+ return err
83+
+ }
84+
missing, err := d.c.deleteOneSignature(url)
85+
if err != nil {
86+
return err
87+
diff --git a/vendor/github.com/containers/image/v5/docker/docker_image_src.go b/vendor/github.com/containers/image/v5/docker/docker_image_src.go
88+
index 314e9b39..43ca0c4f 100644
89+
--- a/vendor/github.com/containers/image/v5/docker/docker_image_src.go
90+
+++ b/vendor/github.com/containers/image/v5/docker/docker_image_src.go
91+
@@ -178,6 +178,9 @@ func simplifyContentType(contentType string) string {
92+
// this never happens if the primary manifest is not a manifest list (e.g. if the source never returns manifest lists).
93+
func (s *dockerImageSource) GetManifest(ctx context.Context, instanceDigest *digest.Digest) ([]byte, string, error) {
94+
if instanceDigest != nil {
95+
+ if err := instanceDigest.Validate(); err != nil { // Make sure instanceDigest.String() does not contain any unexpected characters
96+
+ return nil, "", err
97+
+ }
98+
return s.fetchManifest(ctx, instanceDigest.String())
99+
}
100+
err := s.ensureManifestIsLoaded(ctx)
101+
@@ -373,6 +376,9 @@ func (s *dockerImageSource) GetBlobAt(ctx context.Context, info types.BlobInfo,
102+
return nil, nil, fmt.Errorf("external URLs not supported with GetBlobAt")
103+
}
104+
105+
+ if err := info.Digest.Validate(); err != nil { // Make sure info.Digest.String() does not contain any unexpected characters
106+
+ return nil, nil, err
107+
+ }
108+
path := fmt.Sprintf(blobsPath, reference.Path(s.physicalRef.ref), info.Digest.String())
109+
logrus.Debugf("Downloading %s", path)
110+
res, err := s.c.makeRequest(ctx, http.MethodGet, path, headers, nil, v2Auth, nil)
111+
@@ -425,6 +431,9 @@ func (s *dockerImageSource) GetBlob(ctx context.Context, info types.BlobInfo, ca
112+
}
113+
}
114+
115+
+ if err := info.Digest.Validate(); err != nil { // Make sure info.Digest.String() does not contain any unexpected characters
116+
+ return nil, 0, err
117+
+ }
118+
path := fmt.Sprintf(blobsPath, reference.Path(s.physicalRef.ref), info.Digest.String())
119+
logrus.Debugf("Downloading %s", path)
120+
res, err := s.c.makeRequest(ctx, http.MethodGet, path, nil, nil, v2Auth, nil)
121+
@@ -486,7 +495,10 @@ func (s *dockerImageSource) getSignaturesFromLookaside(ctx context.Context, inst
122+
// NOTE: Keep this in sync with docs/signature-protocols.md!
123+
signatures := [][]byte{}
124+
for i := 0; ; i++ {
125+
- url := signatureStorageURL(s.c.signatureBase, manifestDigest, i)
126+
+ url, err := signatureStorageURL(s.c.signatureBase, manifestDigest, i)
127+
+ if err != nil {
128+
+ return nil, err
129+
+ }
130+
signature, missing, err := s.getOneSignature(ctx, url)
131+
if err != nil {
132+
return nil, err
133+
@@ -627,7 +639,10 @@ func deleteImage(ctx context.Context, sys *types.SystemContext, ref dockerRefere
134+
}
135+
136+
for i := 0; ; i++ {
137+
- url := signatureStorageURL(c.signatureBase, manifestDigest, i)
138+
+ url, err := signatureStorageURL(c.signatureBase, manifestDigest, i)
139+
+ if err != nil {
140+
+ return err
141+
+ }
142+
missing, err := c.deleteOneSignature(url)
143+
if err != nil {
144+
return err
145+
diff --git a/vendor/github.com/containers/image/v5/docker/lookaside.go b/vendor/github.com/containers/image/v5/docker/lookaside.go
146+
index 515e5932..2e400c09 100644
147+
--- a/vendor/github.com/containers/image/v5/docker/lookaside.go
148+
+++ b/vendor/github.com/containers/image/v5/docker/lookaside.go
149+
@@ -229,8 +229,11 @@ func (ns registryNamespace) signatureTopLevel(write bool) string {
150+
// signatureStorageURL returns an URL usable for accessing signature index in base with known manifestDigest.
151+
// base is not nil from the caller
152+
// NOTE: Keep this in sync with docs/signature-protocols.md!
153+
-func signatureStorageURL(base signatureStorageBase, manifestDigest digest.Digest, index int) *url.URL {
154+
+func signatureStorageURL(base signatureStorageBase, manifestDigest digest.Digest, index int) (*url.URL, error) {
155+
+ if err := manifestDigest.Validate(); err != nil { // digest.Digest.Hex() panics on failure, and could possibly result in a path with ../, so validate explicitly.
156+
+ return nil, err
157+
+ }
158+
url := *base
159+
url.Path = fmt.Sprintf("%s@%s=%s/signature-%d", url.Path, manifestDigest.Algorithm(), manifestDigest.Hex(), index+1)
160+
- return &url
161+
+ return &url, nil
162+
}
163+
--
164+
2.34.1
165+

‎SPECS/containerized-data-importer/containerized-data-importer.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
Summary: Container native virtualization
1919
Name: containerized-data-importer
2020
Version: 1.55.0
21-
Release: 18%{?dist}
21+
Release: 19%{?dist}
2222
License: ASL 2.0
2323
Vendor: Microsoft Corporation
2424
Distribution: Mariner
@@ -34,6 +34,7 @@ BuildRequires: sed
3434
Provides: cdi = %{version}-%{release}
3535
ExclusiveArch: x86_64 aarch64
3636
Patch0: CVE-2023-44487.patch
37+
Patch1: CVE-2024-3727.patch
3738

3839
%description
3940
Containerized-Data-Importer (CDI) is a persistent storage management add-on for Kubernetes
@@ -201,6 +202,9 @@ install -m 0644 _out/manifests/release/cdi-cr.yaml %{buildroot}%{_datadir}/cdi/m
201202
%{_datadir}/cdi/manifests
202203

203204
%changelog
205+
* Thu Jun 06 2024 Brian Fjeldstad <bfjelds@microsoft.com> - 1.55.0-19
206+
- Address CVE-2024-3727 by patching vendored github.com/containers/image
207+
204208
* Thu Jun 06 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 1.55.0-18
205209
- Bump release to rebuild with go 1.21.11
206210

0 commit comments

Comments
 (0)