Skip to content

Commit d576911

Browse files
CBL-Mariner-Botkgodara912Kshitiz Godara
authored
Merge PR "[AUTO-CHERRYPICK] Patch cni for CVE-2022-32149 [HIGH] and CVE-2024-45338 [MEDIUM] - branch main" #14787
Co-authored-by: kgodara912 <kshigodara@outlook.com> Co-authored-by: Kshitiz Godara <kgodara@microsoft.com>
1 parent 6a21314 commit d576911

File tree

3 files changed

+155
-4
lines changed

3 files changed

+155
-4
lines changed

‎SPECS/cni/CVE-2022-32149.patch‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
From c170bff65d3f42c52b94b0dbec981f57f696547e Mon Sep 17 00:00:00 2001
2+
From: Roland Shoemaker <bracewell@google.com>
3+
Date: Fri, 2 Sep 2022 09:35:37 -0700
4+
Subject: [PATCH] language: reject excessively large Accept-Language strings
5+
6+
The BCP 47 tag parser has quadratic time complexity due to inherent
7+
aspects of its design. Since the parser is, by design, exposed to
8+
untrusted user input, this can be leveraged to force a program to
9+
consume significant time parsing Accept-Language headers.
10+
11+
The parser cannot be easily rewritten to fix this behavior for
12+
various reasons. Instead the solution implemented in this CL is to
13+
limit the total complexity of tags passed into ParseAcceptLanguage
14+
by limiting the number of dashes in the string to 1000. This should
15+
be more than enough for the majority of real world use cases, where
16+
the number of tags being sent is likely to be in the single digits.
17+
18+
Thanks to the OSS-Fuzz project for discovering this issue and to Adam
19+
Korczynski (ADA Logics) for writing the fuzz case and for reporting the
20+
issue.
21+
22+
Fixes CVE-2022-32149
23+
Fixes golang/go#56152
24+
25+
Change-Id: I7bda1d84cee2b945039c203f26869d58ee9374ae
26+
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1565112
27+
Reviewed-by: Damien Neil <dneil@google.com>
28+
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
29+
Reviewed-on: https://go-review.googlesource.com/c/text/+/442235
30+
TryBot-Result: Gopher Robot <gobot@golang.org>
31+
Auto-Submit: Roland Shoemaker <roland@golang.org>
32+
Run-TryBot: Roland Shoemaker <roland@golang.org>
33+
Signed-off-by: Kshitiz Godara <kgodara@microsoft.com>
34+
Upstream-reference: https://github.com/golang/text/commit/434eadcdbc3b0256971992e8c70027278364c72c.patch
35+
---
36+
vendor/golang.org/x/text/language/parse.go | 5 +++++
37+
1 file changed, 5 insertions(+)
38+
39+
diff --git a/vendor/golang.org/x/text/language/parse.go b/vendor/golang.org/x/text/language/parse.go
40+
index 11acfd8..3bba19f 100644
41+
--- a/vendor/golang.org/x/text/language/parse.go
42+
+++ b/vendor/golang.org/x/text/language/parse.go
43+
@@ -133,6 +133,7 @@ func update(b *language.Builder, part ...interface{}) (err error) {
44+
}
45+
46+
var errInvalidWeight = errors.New("ParseAcceptLanguage: invalid weight")
47+
+var errTagListTooLarge = errors.New("tag list exceeds max length")
48+
49+
// ParseAcceptLanguage parses the contents of an Accept-Language header as
50+
// defined in http://www.ietf.org/rfc/rfc2616.txt and returns a list of Tags and
51+
@@ -142,6 +143,10 @@ var errInvalidWeight = errors.New("ParseAcceptLanguage: invalid weight")
52+
// Tags with a weight of zero will be dropped. An error will be returned if the
53+
// input could not be parsed.
54+
func ParseAcceptLanguage(s string) (tag []Tag, q []float32, err error) {
55+
+ if strings.Count(s, "-") > 1000 {
56+
+ return nil, nil, errTagListTooLarge
57+
+ }
58+
+
59+
var entry string
60+
for s != "" {
61+
if entry, s = split(s, ','); entry == "" {
62+
--
63+
2.45.4
64+

‎SPECS/cni/CVE-2024-45338.patch‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
From eafb912b15b9713c4f977114d3b25358bcb3066f Mon Sep 17 00:00:00 2001
2+
From: Roland Shoemaker <roland@golang.org>
3+
Date: Wed, 4 Dec 2024 09:35:55 -0800
4+
Subject: [PATCH] html: use strings.EqualFold instead of lowering ourselves
5+
6+
Instead of using strings.ToLower and == to check case insensitive
7+
equality, just use strings.EqualFold, even when the strings are only
8+
ASCII. This prevents us unnecessarily lowering extremely long strings,
9+
which can be a somewhat expensive operation, even if we're only
10+
attempting to compare equality with five characters.
11+
12+
Thanks to Guido Vranken for reporting this issue.
13+
14+
Fixes golang/go#70906
15+
Fixes CVE-2024-45338
16+
17+
Change-Id: I323b919f912d60dab6a87cadfdcac3e6b54cd128
18+
Reviewed-on: https://go-review.googlesource.com/c/net/+/637536
19+
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
20+
Auto-Submit: Gopher Robot <gobot@golang.org>
21+
Reviewed-by: Roland Shoemaker <roland@golang.org>
22+
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
23+
Signed-off-by: Kshitiz Godara <kgodara@microsoft.com>
24+
Upstream-reference: https://github.com/golang/net/commit/8e66b04771e35c4e4125e8c60334b34e2423effb.patch
25+
---
26+
vendor/golang.org/x/net/html/doctype.go | 2 +-
27+
vendor/golang.org/x/net/html/foreign.go | 3 +--
28+
vendor/golang.org/x/net/html/parse.go | 4 ++--
29+
3 files changed, 4 insertions(+), 5 deletions(-)
30+
31+
diff --git a/vendor/golang.org/x/net/html/doctype.go b/vendor/golang.org/x/net/html/doctype.go
32+
index c484e5a..bca3ae9 100644
33+
--- a/vendor/golang.org/x/net/html/doctype.go
34+
+++ b/vendor/golang.org/x/net/html/doctype.go
35+
@@ -87,7 +87,7 @@ func parseDoctype(s string) (n *Node, quirks bool) {
36+
}
37+
}
38+
if lastAttr := n.Attr[len(n.Attr)-1]; lastAttr.Key == "system" &&
39+
- strings.ToLower(lastAttr.Val) == "http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd" {
40+
+ strings.EqualFold(lastAttr.Val, "http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd") {
41+
quirks = true
42+
}
43+
}
44+
diff --git a/vendor/golang.org/x/net/html/foreign.go b/vendor/golang.org/x/net/html/foreign.go
45+
index 74774c4..d6aa84d 100644
46+
--- a/vendor/golang.org/x/net/html/foreign.go
47+
+++ b/vendor/golang.org/x/net/html/foreign.go
48+
@@ -40,8 +40,7 @@ func htmlIntegrationPoint(n *Node) bool {
49+
if n.Data == "annotation-xml" {
50+
for _, a := range n.Attr {
51+
if a.Key == "encoding" {
52+
- val := strings.ToLower(a.Val)
53+
- if val == "text/html" || val == "application/xhtml+xml" {
54+
+ if strings.EqualFold(a.Val, "text/html") || strings.EqualFold(a.Val, "application/xhtml+xml") {
55+
return true
56+
}
57+
}
58+
diff --git a/vendor/golang.org/x/net/html/parse.go b/vendor/golang.org/x/net/html/parse.go
59+
index 2cd12fc..851dc42 100644
60+
--- a/vendor/golang.org/x/net/html/parse.go
61+
+++ b/vendor/golang.org/x/net/html/parse.go
62+
@@ -1007,7 +1007,7 @@ func inBodyIM(p *parser) bool {
63+
if p.tok.DataAtom == a.Input {
64+
for _, t := range p.tok.Attr {
65+
if t.Key == "type" {
66+
- if strings.ToLower(t.Val) == "hidden" {
67+
+ if strings.EqualFold(t.Val, "hidden") {
68+
// Skip setting framesetOK = false
69+
return true
70+
}
71+
@@ -1435,7 +1435,7 @@ func inTableIM(p *parser) bool {
72+
return inHeadIM(p)
73+
case a.Input:
74+
for _, t := range p.tok.Attr {
75+
- if t.Key == "type" && strings.ToLower(t.Val) == "hidden" {
76+
+ if t.Key == "type" && strings.EqualFold(t.Val, "hidden") {
77+
p.addElement()
78+
p.oe.pop()
79+
return true
80+
--
81+
2.45.4
82+

‎SPECS/cni/cni.spec‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
Summary: Container Network Interface - networking for Linux containers
2525
Name: cni
2626
Version: 1.0.1
27-
Release: 19%{?dist}
27+
Release: 20%{?dist}
2828
License: Apache-2.0
2929
Vendor: Microsoft Corporation
3030
Distribution: Mariner
@@ -48,6 +48,8 @@ Source2: build.sh
4848
# -cf %%{name}-%%{version}-vendor.tar.gz vendor
4949
#
5050
Source3: %{name}-%{version}-vendor.tar.gz
51+
Patch0: CVE-2022-32149.patch
52+
Patch1: CVE-2024-45338.patch
5153
BuildRequires: golang
5254
BuildRequires: systemd-rpm-macros
5355
BuildRequires: xz
@@ -66,12 +68,12 @@ range of support and the specification is simple to implement.
6668

6769
%prep
6870
%setup -q
69-
cp %{SOURCE2} build.sh
70-
71-
%build
7271
# create vendor folder from the vendor tarball and set vendor mode
7372
tar -xf %{SOURCE3} --no-same-owner
73+
cp %{SOURCE2} build.sh
74+
%autopatch -p1
7475

76+
%build
7577
# go1.16+ default is GO111MODULE=on set to auto temporarily
7678
# until using upstream release with go.mod
7779
export GO111MODULE=auto
@@ -113,6 +115,9 @@ install -m 755 -d "%{buildroot}%{cni_doc_dir}"
113115
%{_sbindir}/cnitool
114116

115117
%changelog
118+
* Mon Sep 08 2025 Kshitiz Godara <kgodara@microsoft.com> - 1.0.1-20
119+
- Patch for CVE-2022-32149 and CVE-2024-45338
120+
116121
* Thu Sep 04 2025 Akhila Guruju <v-guakhila@microsoft.com> - 1.0.1-19
117122
- Bump release to rebuild with golang
118123

0 commit comments

Comments
 (0)