Skip to content

Commit 47e1479

Browse files
[AUTO-CHERRYPICK] Fix CVE-2024-24786 in multiple packages by patching - branch 3.0-dev (#11285)
Co-authored-by: Bala <kumaran.4353@gmail.com>
1 parent 6c23d77 commit 47e1479

26 files changed

Lines changed: 2049 additions & 15 deletions

SPECS/cf-cli/CVE-2024-24786.patch

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
From 1576982839ab9771784526720ed0a2f4a2aa2280 Mon Sep 17 00:00:00 2001
2+
From: bala <balakumaran.kannan@microsoft.com>
3+
Date: Mon, 25 Nov 2024 16:47:53 +0000
4+
Subject: [PATCH] Vendor patch applied
5+
6+
---
7+
.../protobuf/encoding/protojson/decode.go | 12 ++++
8+
.../encoding/protojson/well_known_types.go | 59 +++++++------------
9+
.../protobuf/internal/encoding/json/decode.go | 2 +-
10+
3 files changed, 33 insertions(+), 40 deletions(-)
11+
12+
diff --git a/vendor/google.golang.org/protobuf/encoding/protojson/decode.go b/vendor/google.golang.org/protobuf/encoding/protojson/decode.go
13+
index 5f28148..67fe4e7 100644
14+
--- a/vendor/google.golang.org/protobuf/encoding/protojson/decode.go
15+
+++ b/vendor/google.golang.org/protobuf/encoding/protojson/decode.go
16+
@@ -11,6 +11,7 @@ import (
17+
"strconv"
18+
"strings"
19+
20+
+ "google.golang.org/protobuf/encoding/protowire"
21+
"google.golang.org/protobuf/internal/encoding/json"
22+
"google.golang.org/protobuf/internal/encoding/messageset"
23+
"google.golang.org/protobuf/internal/errors"
24+
@@ -47,6 +48,10 @@ type UnmarshalOptions struct {
25+
protoregistry.MessageTypeResolver
26+
protoregistry.ExtensionTypeResolver
27+
}
28+
+
29+
+ // RecursionLimit limits how deeply messages may be nested.
30+
+ // If zero, a default limit is applied.
31+
+ RecursionLimit int
32+
}
33+
34+
// Unmarshal reads the given []byte and populates the given proto.Message
35+
@@ -67,6 +72,9 @@ func (o UnmarshalOptions) unmarshal(b []byte, m proto.Message) error {
36+
if o.Resolver == nil {
37+
o.Resolver = protoregistry.GlobalTypes
38+
}
39+
+ if o.RecursionLimit == 0 {
40+
+ o.RecursionLimit = protowire.DefaultRecursionLimit
41+
+ }
42+
43+
dec := decoder{json.NewDecoder(b), o}
44+
if err := dec.unmarshalMessage(m.ProtoReflect(), false); err != nil {
45+
@@ -114,6 +122,10 @@ func (d decoder) syntaxError(pos int, f string, x ...interface{}) error {
46+
47+
// unmarshalMessage unmarshals a message into the given protoreflect.Message.
48+
func (d decoder) unmarshalMessage(m protoreflect.Message, skipTypeURL bool) error {
49+
+ d.opts.RecursionLimit--
50+
+ if d.opts.RecursionLimit < 0 {
51+
+ return errors.New("exceeded max recursion depth")
52+
+ }
53+
if unmarshal := wellKnownTypeUnmarshaler(m.Descriptor().FullName()); unmarshal != nil {
54+
return unmarshal(d, m)
55+
}
56+
diff --git a/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go b/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
57+
index 6c37d41..4b177c8 100644
58+
--- a/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
59+
+++ b/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
60+
@@ -176,7 +176,7 @@ func (d decoder) unmarshalAny(m protoreflect.Message) error {
61+
// Use another decoder to parse the unread bytes for @type field. This
62+
// avoids advancing a read from current decoder because the current JSON
63+
// object may contain the fields of the embedded type.
64+
- dec := decoder{d.Clone(), UnmarshalOptions{}}
65+
+ dec := decoder{d.Clone(), UnmarshalOptions{RecursionLimit: d.opts.RecursionLimit}}
66+
tok, err := findTypeURL(dec)
67+
switch err {
68+
case errEmptyObject:
69+
@@ -308,48 +308,29 @@ Loop:
70+
// array) in order to advance the read to the next JSON value. It relies on
71+
// the decoder returning an error if the types are not in valid sequence.
72+
func (d decoder) skipJSONValue() error {
73+
- tok, err := d.Read()
74+
- if err != nil {
75+
- return err
76+
- }
77+
- // Only need to continue reading for objects and arrays.
78+
- switch tok.Kind() {
79+
- case json.ObjectOpen:
80+
- for {
81+
- tok, err := d.Read()
82+
- if err != nil {
83+
- return err
84+
- }
85+
- switch tok.Kind() {
86+
- case json.ObjectClose:
87+
- return nil
88+
- case json.Name:
89+
- // Skip object field value.
90+
- if err := d.skipJSONValue(); err != nil {
91+
- return err
92+
- }
93+
- }
94+
+ var open int
95+
+ for {
96+
+ tok, err := d.Read()
97+
+ if err != nil {
98+
+ return err
99+
}
100+
-
101+
- case json.ArrayOpen:
102+
- for {
103+
- tok, err := d.Peek()
104+
- if err != nil {
105+
- return err
106+
- }
107+
- switch tok.Kind() {
108+
- case json.ArrayClose:
109+
- d.Read()
110+
- return nil
111+
- default:
112+
- // Skip array item.
113+
- if err := d.skipJSONValue(); err != nil {
114+
- return err
115+
- }
116+
+ switch tok.Kind() {
117+
+ case json.ObjectClose, json.ArrayClose:
118+
+ open--
119+
+ case json.ObjectOpen, json.ArrayOpen:
120+
+ open++
121+
+ if open > d.opts.RecursionLimit {
122+
+ return errors.New("exceeded max recursion depth")
123+
}
124+
+ case json.EOF:
125+
+ // This can only happen if there's a bug in Decoder.Read.
126+
+ // Avoid an infinite loop if this does happen.
127+
+ return errors.New("unexpected EOF")
128+
+ }
129+
+ if open == 0 {
130+
+ return nil
131+
}
132+
}
133+
- return nil
134+
}
135+
136+
// unmarshalAnyValue unmarshals the given custom-type message from the JSON
137+
diff --git a/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go b/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
138+
index d043a6e..d2b3ac0 100644
139+
--- a/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
140+
+++ b/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
141+
@@ -121,7 +121,7 @@ func (d *Decoder) Read() (Token, error) {
142+
143+
case ObjectClose:
144+
if len(d.openStack) == 0 ||
145+
- d.lastToken.kind == comma ||
146+
+ d.lastToken.kind&(Name|comma) != 0 ||
147+
d.openStack[len(d.openStack)-1] != ObjectOpen {
148+
return Token{}, d.newSyntaxError(tok.pos, unexpectedFmt, tok.RawString())
149+
}
150+
--
151+
2.39.4
152+

SPECS/cf-cli/cf-cli.spec

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ Summary: The official command line client for Cloud Foundry.
55
Name: cf-cli
66
# Note: Upgrading the package also warrants an upgrade in the CF_BUILD_SHA
77
Version: 8.7.3
8-
Release: 2%{?dist}
8+
Release: 3%{?dist}
99
License: Apache-2.0
1010
Vendor: Microsoft Corporation
1111
Distribution: Azure Linux
@@ -32,6 +32,7 @@ Source0: https://github.com/cloudfoundry/cli/archive/refs/tags/v%{version
3232
# - For the value of "--mtime" use the date "2021-04-26 00:00Z" to simplify future updates.
3333
Source1: cli-%{version}-vendor.tar.gz
3434
Patch0: CVE-2023-39325.patch
35+
Patch1: CVE-2024-24786.patch
3536

3637
BuildRequires: golang >= 1.18.3
3738
%global debug_package %{nil}
@@ -44,6 +45,7 @@ The official command line client for Cloud Foundry.
4445
%setup -q -n cli-%{version}
4546
tar --no-same-owner -xf %{SOURCE1}
4647
%patch 0 -p1
48+
%patch 1 -p1
4749

4850
%build
4951
export GOPATH=%{our_gopath}
@@ -65,6 +67,9 @@ install -p -m 755 -t %{buildroot}%{_bindir} ./out/cf
6567
%{_bindir}/cf
6668

6769
%changelog
70+
* Mon Nov 25 2024 Bala <balakumaran.kannan@microsoft.com> - 8.7.3-3
71+
- Fix CVE-2024-24786
72+
6873
* Mon Jul 29 2024 Muhammad Falak <mwani@microsoft.com> - 8.7.3-2
6974
- Fix CF_BUILD_SHA to have correct build sha in the binary
7075
- Move Source1 un-taring in prep section
Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
From 1576982839ab9771784526720ed0a2f4a2aa2280 Mon Sep 17 00:00:00 2001
2+
From: bala <balakumaran.kannan@microsoft.com>
3+
Date: Mon, 25 Nov 2024 16:47:53 +0000
4+
Subject: [PATCH] Vendor patch applied
5+
6+
---
7+
.../protobuf/encoding/protojson/decode.go | 12 ++++
8+
.../encoding/protojson/well_known_types.go | 59 +++++++------------
9+
.../protobuf/internal/encoding/json/decode.go | 2 +-
10+
3 files changed, 33 insertions(+), 40 deletions(-)
11+
12+
diff --git a/vendor/google.golang.org/protobuf/encoding/protojson/decode.go b/vendor/google.golang.org/protobuf/encoding/protojson/decode.go
13+
index 5f28148..67fe4e7 100644
14+
--- a/vendor/google.golang.org/protobuf/encoding/protojson/decode.go
15+
+++ b/vendor/google.golang.org/protobuf/encoding/protojson/decode.go
16+
@@ -11,6 +11,7 @@ import (
17+
"strconv"
18+
"strings"
19+
20+
+ "google.golang.org/protobuf/encoding/protowire"
21+
"google.golang.org/protobuf/internal/encoding/json"
22+
"google.golang.org/protobuf/internal/encoding/messageset"
23+
"google.golang.org/protobuf/internal/errors"
24+
@@ -47,6 +48,10 @@ type UnmarshalOptions struct {
25+
protoregistry.MessageTypeResolver
26+
protoregistry.ExtensionTypeResolver
27+
}
28+
+
29+
+ // RecursionLimit limits how deeply messages may be nested.
30+
+ // If zero, a default limit is applied.
31+
+ RecursionLimit int
32+
}
33+
34+
// Unmarshal reads the given []byte and populates the given proto.Message
35+
@@ -67,6 +72,9 @@ func (o UnmarshalOptions) unmarshal(b []byte, m proto.Message) error {
36+
if o.Resolver == nil {
37+
o.Resolver = protoregistry.GlobalTypes
38+
}
39+
+ if o.RecursionLimit == 0 {
40+
+ o.RecursionLimit = protowire.DefaultRecursionLimit
41+
+ }
42+
43+
dec := decoder{json.NewDecoder(b), o}
44+
if err := dec.unmarshalMessage(m.ProtoReflect(), false); err != nil {
45+
@@ -114,6 +122,10 @@ func (d decoder) syntaxError(pos int, f string, x ...interface{}) error {
46+
47+
// unmarshalMessage unmarshals a message into the given protoreflect.Message.
48+
func (d decoder) unmarshalMessage(m protoreflect.Message, skipTypeURL bool) error {
49+
+ d.opts.RecursionLimit--
50+
+ if d.opts.RecursionLimit < 0 {
51+
+ return errors.New("exceeded max recursion depth")
52+
+ }
53+
if unmarshal := wellKnownTypeUnmarshaler(m.Descriptor().FullName()); unmarshal != nil {
54+
return unmarshal(d, m)
55+
}
56+
diff --git a/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go b/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
57+
index 6c37d41..4b177c8 100644
58+
--- a/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
59+
+++ b/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
60+
@@ -176,7 +176,7 @@ func (d decoder) unmarshalAny(m protoreflect.Message) error {
61+
// Use another decoder to parse the unread bytes for @type field. This
62+
// avoids advancing a read from current decoder because the current JSON
63+
// object may contain the fields of the embedded type.
64+
- dec := decoder{d.Clone(), UnmarshalOptions{}}
65+
+ dec := decoder{d.Clone(), UnmarshalOptions{RecursionLimit: d.opts.RecursionLimit}}
66+
tok, err := findTypeURL(dec)
67+
switch err {
68+
case errEmptyObject:
69+
@@ -308,48 +308,29 @@ Loop:
70+
// array) in order to advance the read to the next JSON value. It relies on
71+
// the decoder returning an error if the types are not in valid sequence.
72+
func (d decoder) skipJSONValue() error {
73+
- tok, err := d.Read()
74+
- if err != nil {
75+
- return err
76+
- }
77+
- // Only need to continue reading for objects and arrays.
78+
- switch tok.Kind() {
79+
- case json.ObjectOpen:
80+
- for {
81+
- tok, err := d.Read()
82+
- if err != nil {
83+
- return err
84+
- }
85+
- switch tok.Kind() {
86+
- case json.ObjectClose:
87+
- return nil
88+
- case json.Name:
89+
- // Skip object field value.
90+
- if err := d.skipJSONValue(); err != nil {
91+
- return err
92+
- }
93+
- }
94+
+ var open int
95+
+ for {
96+
+ tok, err := d.Read()
97+
+ if err != nil {
98+
+ return err
99+
}
100+
-
101+
- case json.ArrayOpen:
102+
- for {
103+
- tok, err := d.Peek()
104+
- if err != nil {
105+
- return err
106+
- }
107+
- switch tok.Kind() {
108+
- case json.ArrayClose:
109+
- d.Read()
110+
- return nil
111+
- default:
112+
- // Skip array item.
113+
- if err := d.skipJSONValue(); err != nil {
114+
- return err
115+
- }
116+
+ switch tok.Kind() {
117+
+ case json.ObjectClose, json.ArrayClose:
118+
+ open--
119+
+ case json.ObjectOpen, json.ArrayOpen:
120+
+ open++
121+
+ if open > d.opts.RecursionLimit {
122+
+ return errors.New("exceeded max recursion depth")
123+
}
124+
+ case json.EOF:
125+
+ // This can only happen if there's a bug in Decoder.Read.
126+
+ // Avoid an infinite loop if this does happen.
127+
+ return errors.New("unexpected EOF")
128+
+ }
129+
+ if open == 0 {
130+
+ return nil
131+
}
132+
}
133+
- return nil
134+
}
135+
136+
// unmarshalAnyValue unmarshals the given custom-type message from the JSON
137+
diff --git a/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go b/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
138+
index d043a6e..d2b3ac0 100644
139+
--- a/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
140+
+++ b/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
141+
@@ -121,7 +121,7 @@ func (d *Decoder) Read() (Token, error) {
142+
143+
case ObjectClose:
144+
if len(d.openStack) == 0 ||
145+
- d.lastToken.kind == comma ||
146+
+ d.lastToken.kind&(Name|comma) != 0 ||
147+
d.openStack[len(d.openStack)-1] != ObjectOpen {
148+
return Token{}, d.newSyntaxError(tok.pos, unexpectedFmt, tok.RawString())
149+
}
150+
--
151+
2.39.4
152+

SPECS/containerd/containerd.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
Summary: Industry-standard container runtime
55
Name: containerd
66
Version: 1.7.13
7-
Release: 4%{?dist}
7+
Release: 5%{?dist}
88
License: ASL 2.0
99
Group: Tools/Container
1010
URL: https://www.containerd.io
@@ -18,6 +18,7 @@ Patch0: Makefile.patch
1818
Patch1: fix_tests_for_golang1.21.patch
1919
Patch2: CVE-2023-44487.patch
2020
Patch3: CVE-2023-47108.patch
21+
Patch4: CVE-2024-24786.patch
2122

2223
%{?systemd_requires}
2324

@@ -87,6 +88,9 @@ fi
8788
%dir /opt/containerd/lib
8889

8990
%changelog
91+
* Mon Nov 25 2024 Bala <balakumaran.kannan@microsoft.com> - 1.7.13-5
92+
- Fix CVE-2024-24786
93+
9094
* Tue Oct 15 2024 Muhammad Falak <mwani@microsoft.com> - 1.7.13-4
9195
- Pin golang version to <= 1.22
9296

0 commit comments

Comments
 (0)