Skip to content

Commit 5e30b74

Browse files
[AUTO-CHERRYPICK] Patch local-path-provisioner to fix CVE-2023-39325, CVE-2023-45288 - branch 3.0-dev (#12499)
Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>
1 parent 7c16b01 commit 5e30b74

3 files changed

Lines changed: 219 additions & 3 deletions

File tree

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
From aa710e1624a59109fa963de2afc047e411f2c268 Mon Sep 17 00:00:00 2001
2+
From: Kanishk-Bansal <kbkanishk975@gmail.com>
3+
Date: Fri, 14 Feb 2025 12:37:21 +0000
4+
Subject: [PATCH] CVE-2023-39325
5+
6+
---
7+
vendor/golang.org/x/net/http2/server.go | 66 ++++++++++++++++++++++++-
8+
1 file changed, 64 insertions(+), 2 deletions(-)
9+
10+
diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go
11+
index 8cb14f3..6000140 100644
12+
--- a/vendor/golang.org/x/net/http2/server.go
13+
+++ b/vendor/golang.org/x/net/http2/server.go
14+
@@ -581,9 +581,11 @@ type serverConn struct {
15+
advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client
16+
curClientStreams uint32 // number of open streams initiated by the client
17+
curPushedStreams uint32 // number of open streams initiated by server push
18+
+ curHandlers uint32 // number of running handler goroutines
19+
maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests
20+
maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes
21+
streams map[uint32]*stream
22+
+ unstartedHandlers []unstartedHandler
23+
initialStreamSendWindowSize int32
24+
maxFrameSize int32
25+
peerMaxHeaderListSize uint32 // zero means unknown (default)
26+
@@ -981,6 +983,8 @@ func (sc *serverConn) serve() {
27+
return
28+
case gracefulShutdownMsg:
29+
sc.startGracefulShutdownInternal()
30+
+ case handlerDoneMsg:
31+
+ sc.handlerDone()
32+
default:
33+
panic("unknown timer")
34+
}
35+
@@ -1028,6 +1032,7 @@ var (
36+
idleTimerMsg = new(serverMessage)
37+
shutdownTimerMsg = new(serverMessage)
38+
gracefulShutdownMsg = new(serverMessage)
39+
+ handlerDoneMsg = new(serverMessage)
40+
)
41+
42+
func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) }
43+
@@ -2022,8 +2027,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error {
44+
}
45+
}
46+
47+
- go sc.runHandler(rw, req, handler)
48+
- return nil
49+
+ return sc.scheduleHandler(id, rw, req, handler)
50+
}
51+
52+
func (sc *serverConn) upgradeRequest(req *http.Request) {
53+
@@ -2043,6 +2047,10 @@ func (sc *serverConn) upgradeRequest(req *http.Request) {
54+
sc.conn.SetReadDeadline(time.Time{})
55+
}
56+
57+
+ // This is the first request on the connection,
58+
+ // so start the handler directly rather than going
59+
+ // through scheduleHandler.
60+
+ sc.curHandlers++
61+
go sc.runHandler(rw, req, sc.handler.ServeHTTP)
62+
}
63+
64+
@@ -2283,8 +2291,62 @@ func (sc *serverConn) newResponseWriter(st *stream, req *http.Request) *response
65+
return &responseWriter{rws: rws}
66+
}
67+
68+
+type unstartedHandler struct {
69+
+ streamID uint32
70+
+ rw *responseWriter
71+
+ req *http.Request
72+
+ handler func(http.ResponseWriter, *http.Request)
73+
+}
74+
+
75+
+// scheduleHandler starts a handler goroutine,
76+
+// or schedules one to start as soon as an existing handler finishes.
77+
+func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error {
78+
+ sc.serveG.check()
79+
+ maxHandlers := sc.advMaxStreams
80+
+ if sc.curHandlers < maxHandlers {
81+
+ sc.curHandlers++
82+
+ go sc.runHandler(rw, req, handler)
83+
+ return nil
84+
+ }
85+
+ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) {
86+
+ return sc.countError("too_many_early_resets", ConnectionError(ErrCodeEnhanceYourCalm))
87+
+ }
88+
+ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{
89+
+ streamID: streamID,
90+
+ rw: rw,
91+
+ req: req,
92+
+ handler: handler,
93+
+ })
94+
+ return nil
95+
+}
96+
+
97+
+func (sc *serverConn) handlerDone() {
98+
+ sc.serveG.check()
99+
+ sc.curHandlers--
100+
+ i := 0
101+
+ maxHandlers := sc.advMaxStreams
102+
+ for ; i < len(sc.unstartedHandlers); i++ {
103+
+ u := sc.unstartedHandlers[i]
104+
+ if sc.streams[u.streamID] == nil {
105+
+ // This stream was reset before its goroutine had a chance to start.
106+
+ continue
107+
+ }
108+
+ if sc.curHandlers >= maxHandlers {
109+
+ break
110+
+ }
111+
+ sc.curHandlers++
112+
+ go sc.runHandler(u.rw, u.req, u.handler)
113+
+ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references
114+
+ }
115+
+ sc.unstartedHandlers = sc.unstartedHandlers[i:]
116+
+ if len(sc.unstartedHandlers) == 0 {
117+
+ sc.unstartedHandlers = nil
118+
+ }
119+
+}
120+
+
121+
// Run on its own goroutine.
122+
func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) {
123+
+ defer sc.sendServeMsg(handlerDoneMsg)
124+
didPanic := true
125+
defer func() {
126+
rw.rws.stream.cancelCtx()
127+
--
128+
2.45.2
129+
Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
Author: Damien Neil <dneil@google.com>
2+
AuthorDate: 2024-01-10 13:41:39 -0800
3+
Commit: Gopher Robot <gobot@golang.org>
4+
CommitDate: 2024-04-03 17:06:00 +0000
5+
6+
[internal-branch.go1.21-vendor] http2: close connections when receiving too many headers
7+
8+
Maintaining HPACK state requires that we parse and process
9+
all HEADERS and CONTINUATION frames on a connection.
10+
When a request's headers exceed MaxHeaderBytes, we don't
11+
allocate memory to store the excess headers but we do
12+
parse them. This permits an attacker to cause an HTTP/2
13+
endpoint to read arbitrary amounts of data, all associated
14+
with a request which is going to be rejected.
15+
16+
Set a limit on the amount of excess header frames we
17+
will process before closing a connection.
18+
19+
Thanks to Bartek Nowotarski for reporting this issue.
20+
21+
Fixes CVE-2023-45288
22+
For golang/go#65051
23+
24+
Change-Id: I15df097268df13bb5a9e9d3a5c04a8a141d850f6
25+
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2130527
26+
Reviewed-by: Roland Shoemaker <bracewell@google.com>
27+
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
28+
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2197243
29+
Run-TryBot: Damien Neil <dneil@google.com>
30+
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
31+
Reviewed-on: https://go-review.googlesource.com/c/net/+/576057
32+
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
33+
Auto-Submit: Dmitri Shuralyov <dmitshur@google.com>
34+
35+
diff --git a/vendor/golang.org/x/net/http2/frame.go b/vendor/golang.org/x/net/http2/frame.go
36+
index c1f6b90..175c154 100644
37+
--- a/vendor/golang.org/x/net/http2/frame.go
38+
+++ b/vendor/golang.org/x/net/http2/frame.go
39+
@@ -1565,6 +1565,7 @@
40+
if size > remainSize {
41+
hdec.SetEmitEnabled(false)
42+
mh.Truncated = true
43+
+ remainSize = 0
44+
return
45+
}
46+
remainSize -= size
47+
@@ -1577,6 +1578,36 @@
48+
var hc headersOrContinuation = hf
49+
for {
50+
frag := hc.HeaderBlockFragment()
51+
+
52+
+ // Avoid parsing large amounts of headers that we will then discard.
53+
+ // If the sender exceeds the max header list size by too much,
54+
+ // skip parsing the fragment and close the connection.
55+
+ //
56+
+ // "Too much" is either any CONTINUATION frame after we've already
57+
+ // exceeded the max header list size (in which case remainSize is 0),
58+
+ // or a frame whose encoded size is more than twice the remaining
59+
+ // header list bytes we're willing to accept.
60+
+ if int64(len(frag)) > int64(2*remainSize) {
61+
+ if VerboseLogs {
62+
+ log.Printf("http2: header list too large")
63+
+ }
64+
+ // It would be nice to send a RST_STREAM before sending the GOAWAY,
65+
+ // but the struture of the server's frame writer makes this difficult.
66+
+ return nil, ConnectionError(ErrCodeProtocol)
67+
+ }
68+
+
69+
+ // Also close the connection after any CONTINUATION frame following an
70+
+ // invalid header, since we stop tracking the size of the headers after
71+
+ // an invalid one.
72+
+ if invalid != nil {
73+
+ if VerboseLogs {
74+
+ log.Printf("http2: invalid header: %v", invalid)
75+
+ }
76+
+ // It would be nice to send a RST_STREAM before sending the GOAWAY,
77+
+ // but the struture of the server's frame writer makes this difficult.
78+
+ return nil, ConnectionError(ErrCodeProtocol)
79+
+ }
80+
+
81+
if _, err := hdec.Write(frag); err != nil {
82+
return nil, ConnectionError(ErrCodeCompression)
83+
}

SPECS/local-path-provisioner/local-path-provisioner.spec

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,23 @@
11
Summary: Provides a way for the Kubernetes users to utilize the local storage in each node
22
Name: local-path-provisioner
33
Version: 0.0.24
4-
Release: 2%{?dist}
4+
Release: 3%{?dist}
55
License: ASL 2.0
66
URL: https://github.com/rancher/local-path-provisioner
77
Group: Applications/Text
88
Vendor: Microsoft Corporation
99
Distribution: Azure Linux
1010
Source0: https://github.com/rancher/%{name}/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
1111
#Note that the source file should be renamed to the format {name}-%{version}.tar.gz
12-
12+
Patch0: CVE-2023-45288.patch
13+
Patch1: CVE-2023-39325.patch
1314
BuildRequires: golang
1415

1516
%description
1617
Provides a way for the Kubernetes users to utilize the local storage in each node.
1718

1819
%prep
19-
%setup -q
20+
%autosetup -p1
2021

2122
%build
2223
export CGO_ENABLED=0
@@ -30,6 +31,9 @@ install local-path-provisioner %{buildroot}%{_bindir}/local-path-provisioner
3031
%{_bindir}/local-path-provisioner
3132

3233
%changelog
34+
* Fri Feb 14 2025 Kanishk Bansal <kanbansal@microsoft.com> - 0.0.24-3
35+
- Address CVE-2023-45288, CVE-2023-39325
36+
3337
* Tue Sep 03 2024 Pawel Winogrodzki <pawelwi@microsoft.com> - 0.0.24-2
3438
- Release bump to fix package information.
3539

0 commit comments

Comments
 (0)