Skip to content

Commit dd9200e

Browse files
CBL-Mariner-Botliunan-ms
CBL-Mariner-Bot
and
liunan-ms
authored
[AUTO-CHERRYPICK] Add patches to address CVE-2021-44716 - branch main (#7875)
Co-authored-by: Nan Liu <108544011+liunan-ms@users.noreply.github.com> Co-authored-by: Nan Liu <liunan@microsoft.com>
1 parent 53323c8 commit dd9200e

8 files changed

Lines changed: 224 additions & 4 deletions

File tree

‎SPECS/node-problem-detector/CVE-2021-44716.patch‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
Parent: db4efeb8 (http2: deflake TestTransportGroupsPendingDials)
2+
Author: Damien Neil <dneil@google.com>
3+
AuthorDate: 2021-12-06 14:31:43 -0800
4+
Commit: Filippo Valsorda <filippo@golang.org>
5+
CommitDate: 2021-12-09 12:49:13 +0000
6+
7+
http2: cap the size of the server's canonical header cache
8+
9+
The HTTP/2 server keeps a per-connection cache mapping header keys
10+
to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the
11+
maximum size of this cache to prevent a peer sending many unique
12+
header keys from causing unbounded memory growth.
13+
14+
Cap chosen arbitrarily at 32 entries. Since this cache does not
15+
include common headers (e.g., "content-type"), 32 seems like more
16+
than enough for almost all normal uses.
17+
18+
Fixes #50058
19+
Fixes CVE-2021-44716
20+
21+
Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105
22+
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827
23+
Reviewed-by: Roland Shoemaker <bracewell@google.com>
24+
Reviewed-on: https://go-review.googlesource.com/c/net/+/369794
25+
Trust: Filippo Valsorda <filippo@golang.org>
26+
Run-TryBot: Filippo Valsorda <filippo@golang.org>
27+
Trust: Damien Neil <dneil@google.com>
28+
Reviewed-by: Russ Cox <rsc@golang.org>
29+
Reviewed-by: Filippo Valsorda <filippo@golang.org>
30+
TryBot-Result: Gopher Robot <gobot@golang.org>
31+
32+
diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/vendor/golang.org/x/net/http2/server.go
33+
--- cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800
34+
+++ cli-20.10.27/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800
35+
@@ -720,7 +720,15 @@
36+
sc.canonHeader = make(map[string]string)
37+
}
38+
cv = http.CanonicalHeaderKey(v)
39+
- sc.canonHeader[v] = cv
40+
+ // maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of
41+
+ // entries in the canonHeader cache. This should be larger than the number
42+
+ // of unique, uncommon header keys likely to be sent by the peer, while not
43+
+ // so high as to permit unreaasonable memory usage if the peer sends an unbounded
44+
+ // number of unique header keys.
45+
+ const maxCachedCanonicalHeaders = 32
46+
+ if len(sc.canonHeader) < maxCachedCanonicalHeaders {
47+
+ sc.canonHeader[v] = cv
48+
+ }
49+
return cv
50+
}
51+

‎SPECS/node-problem-detector/node-problem-detector.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Kubernetes daemon to detect and report node issues
22
Name: node-problem-detector
33
Version: 0.8.10
4-
Release: 19%{?dist}
4+
Release: 20%{?dist}
55
License: ASL 2.0
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -11,6 +11,7 @@ Source0: https://github.com/kubernetes/%{name}/archive/refs/tags/v%{versi
1111
Patch0: 001-remove_arch_specific_makefile_logic.patch
1212
Patch1: 002-add_mariner_OSVersion.patch
1313
Patch2: CVE-2022-21698.patch
14+
Patch3: CVE-2021-44716.patch
1415
BuildRequires: golang
1516
BuildRequires: systemd-devel
1617
Requires: mariner-release
@@ -65,6 +66,9 @@ make test
6566
%config(noreplace) %{_sysconfdir}/node-problem-detector.d/*
6667

6768
%changelog
69+
* Tue Feb 13 2024 Nan Liu <liunan@microsoft.com> - 0.8.10-20
70+
- Patch CVE-2021-44716
71+
6872
* Fri Feb 09 2024 Muhammad Falak <mwani@microsoft.com> - 0.8.10-19
6973
- Bump release to rebuild with go 1.21.6
7074

‎SPECS/prometheus-node-exporter/CVE-2021-44716.patch‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
Parent: db4efeb8 (http2: deflake TestTransportGroupsPendingDials)
2+
Author: Damien Neil <dneil@google.com>
3+
AuthorDate: 2021-12-06 14:31:43 -0800
4+
Commit: Filippo Valsorda <filippo@golang.org>
5+
CommitDate: 2021-12-09 12:49:13 +0000
6+
7+
http2: cap the size of the server's canonical header cache
8+
9+
The HTTP/2 server keeps a per-connection cache mapping header keys
10+
to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the
11+
maximum size of this cache to prevent a peer sending many unique
12+
header keys from causing unbounded memory growth.
13+
14+
Cap chosen arbitrarily at 32 entries. Since this cache does not
15+
include common headers (e.g., "content-type"), 32 seems like more
16+
than enough for almost all normal uses.
17+
18+
Fixes #50058
19+
Fixes CVE-2021-44716
20+
21+
Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105
22+
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827
23+
Reviewed-by: Roland Shoemaker <bracewell@google.com>
24+
Reviewed-on: https://go-review.googlesource.com/c/net/+/369794
25+
Trust: Filippo Valsorda <filippo@golang.org>
26+
Run-TryBot: Filippo Valsorda <filippo@golang.org>
27+
Trust: Damien Neil <dneil@google.com>
28+
Reviewed-by: Russ Cox <rsc@golang.org>
29+
Reviewed-by: Filippo Valsorda <filippo@golang.org>
30+
TryBot-Result: Gopher Robot <gobot@golang.org>
31+
32+
diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/vendor/golang.org/x/net/http2/server.go
33+
--- cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800
34+
+++ cli-20.10.27/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800
35+
@@ -720,7 +720,15 @@
36+
sc.canonHeader = make(map[string]string)
37+
}
38+
cv = http.CanonicalHeaderKey(v)
39+
- sc.canonHeader[v] = cv
40+
+ // maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of
41+
+ // entries in the canonHeader cache. This should be larger than the number
42+
+ // of unique, uncommon header keys likely to be sent by the peer, while not
43+
+ // so high as to permit unreaasonable memory usage if the peer sends an unbounded
44+
+ // number of unique header keys.
45+
+ const maxCachedCanonicalHeaders = 32
46+
+ if len(sc.canonHeader) < maxCachedCanonicalHeaders {
47+
+ sc.canonHeader[v] = cv
48+
+ }
49+
return cv
50+
}
51+

‎SPECS/prometheus-node-exporter/prometheus-node-exporter.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
Summary: Exporter for machine metrics
66
Name: prometheus-node-exporter
77
Version: 1.3.1
8-
Release: 23%{?dist}
8+
Release: 24%{?dist}
99
# Upstream license specification: Apache-2.0
1010
License: ASL 2.0 AND MIT
1111
Vendor: Microsoft Corporation
@@ -39,6 +39,7 @@ Patch1: 0001-Refactor-perf-collector.patch
3939
# Can be removed if we upgrade to prometheus-node-exporter 1.4.0 or later.
4040
Patch2: CVE-2022-21698.patch
4141
Patch3: CVE-2023-44487.patch
42+
Patch4: CVE-2021-44716.patch
4243

4344
BuildRequires: golang
4445
BuildRequires: systemd-rpm-macros
@@ -112,6 +113,9 @@ getent passwd 'prometheus' >/dev/null || useradd -r -g 'prometheus' -d '%{_share
112113
%dir %attr(0755,prometheus,prometheus) %{_sharedstatedir}/prometheus/node-exporter
113114

114115
%changelog
116+
* Tue Feb 13 2024 Nan Liu <liunan@microsoft.com> - 1.3.1-24
117+
- Patch CVE-2021-44716
118+
115119
* Thu Feb 08 2024 Daniel McIlvaney <damcilva@microsoft.com> - 1.3.1-23
116120
- Address CVE-2023-44487 by patching vendored golang.org/x/net
117121

‎SPECS/prometheus-process-exporter/CVE-2021-44716.patch‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
Parent: db4efeb8 (http2: deflake TestTransportGroupsPendingDials)
2+
Author: Damien Neil <dneil@google.com>
3+
AuthorDate: 2021-12-06 14:31:43 -0800
4+
Commit: Filippo Valsorda <filippo@golang.org>
5+
CommitDate: 2021-12-09 12:49:13 +0000
6+
7+
http2: cap the size of the server's canonical header cache
8+
9+
The HTTP/2 server keeps a per-connection cache mapping header keys
10+
to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the
11+
maximum size of this cache to prevent a peer sending many unique
12+
header keys from causing unbounded memory growth.
13+
14+
Cap chosen arbitrarily at 32 entries. Since this cache does not
15+
include common headers (e.g., "content-type"), 32 seems like more
16+
than enough for almost all normal uses.
17+
18+
Fixes #50058
19+
Fixes CVE-2021-44716
20+
21+
Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105
22+
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827
23+
Reviewed-by: Roland Shoemaker <bracewell@google.com>
24+
Reviewed-on: https://go-review.googlesource.com/c/net/+/369794
25+
Trust: Filippo Valsorda <filippo@golang.org>
26+
Run-TryBot: Filippo Valsorda <filippo@golang.org>
27+
Trust: Damien Neil <dneil@google.com>
28+
Reviewed-by: Russ Cox <rsc@golang.org>
29+
Reviewed-by: Filippo Valsorda <filippo@golang.org>
30+
TryBot-Result: Gopher Robot <gobot@golang.org>
31+
32+
diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/vendor/golang.org/x/net/http2/server.go
33+
--- cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800
34+
+++ cli-20.10.27/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800
35+
@@ -720,7 +720,15 @@
36+
sc.canonHeader = make(map[string]string)
37+
}
38+
cv = http.CanonicalHeaderKey(v)
39+
- sc.canonHeader[v] = cv
40+
+ // maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of
41+
+ // entries in the canonHeader cache. This should be larger than the number
42+
+ // of unique, uncommon header keys likely to be sent by the peer, while not
43+
+ // so high as to permit unreaasonable memory usage if the peer sends an unbounded
44+
+ // number of unique header keys.
45+
+ const maxCachedCanonicalHeaders = 32
46+
+ if len(sc.canonHeader) < maxCachedCanonicalHeaders {
47+
+ sc.canonHeader[v] = cv
48+
+ }
49+
return cv
50+
}
51+

‎SPECS/prometheus-process-exporter/prometheus-process-exporter.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
Summary: Prometheus exporter exposing process metrics from procfs
66
Name: prometheus-process-exporter
77
Version: 0.7.10
8-
Release: 18%{?dist}
8+
Release: 19%{?dist}
99
License: MIT
1010
Vendor: Microsoft Corporation
1111
Distribution: Mariner
@@ -33,6 +33,7 @@ Patch1: 03-disable-fakescraper.patch
3333
# Can be removed if we ever update to a version that includes this pull request: https://github.com/ncabatoff/process-exporter/pull/264.
3434
Patch2: CVE-2022-21698.patch
3535
Patch3: CVE-2023-44487.patch
36+
Patch4: CVE-2021-44716.patch
3637

3738
BuildRequires: golang
3839
BuildRequires: systemd-rpm-macros
@@ -101,6 +102,9 @@ getent passwd 'prometheus' >/dev/null || useradd -r -g 'prometheus' -d '%{_share
101102
%dir %attr(0755,prometheus,prometheus) %{_sharedstatedir}/prometheus
102103

103104
%changelog
105+
* Tue Feb 13 2024 Nan Liu <liunan@microsoft.com> - 0.7.10-19
106+
- Patch CVE-2021-44716
107+
104108
* Fri Feb 09 2024 Muhammad Falak <mwani@microsoft.com> - 0.7.10-18
105109
- Bump release to rebuild with go 1.21.6
106110

‎SPECS/rook/CVE-2021-44716.patch‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
Parent: db4efeb8 (http2: deflake TestTransportGroupsPendingDials)
2+
Author: Damien Neil <dneil@google.com>
3+
AuthorDate: 2021-12-06 14:31:43 -0800
4+
Commit: Filippo Valsorda <filippo@golang.org>
5+
CommitDate: 2021-12-09 12:49:13 +0000
6+
7+
http2: cap the size of the server's canonical header cache
8+
9+
The HTTP/2 server keeps a per-connection cache mapping header keys
10+
to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the
11+
maximum size of this cache to prevent a peer sending many unique
12+
header keys from causing unbounded memory growth.
13+
14+
Cap chosen arbitrarily at 32 entries. Since this cache does not
15+
include common headers (e.g., "content-type"), 32 seems like more
16+
than enough for almost all normal uses.
17+
18+
Fixes #50058
19+
Fixes CVE-2021-44716
20+
21+
Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105
22+
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827
23+
Reviewed-by: Roland Shoemaker <bracewell@google.com>
24+
Reviewed-on: https://go-review.googlesource.com/c/net/+/369794
25+
Trust: Filippo Valsorda <filippo@golang.org>
26+
Run-TryBot: Filippo Valsorda <filippo@golang.org>
27+
Trust: Damien Neil <dneil@google.com>
28+
Reviewed-by: Russ Cox <rsc@golang.org>
29+
Reviewed-by: Filippo Valsorda <filippo@golang.org>
30+
TryBot-Result: Gopher Robot <gobot@golang.org>
31+
32+
diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/vendor/golang.org/x/net/http2/server.go
33+
--- cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800
34+
+++ cli-20.10.27/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800
35+
@@ -720,7 +720,15 @@
36+
sc.canonHeader = make(map[string]string)
37+
}
38+
cv = http.CanonicalHeaderKey(v)
39+
- sc.canonHeader[v] = cv
40+
+ // maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of
41+
+ // entries in the canonHeader cache. This should be larger than the number
42+
+ // of unique, uncommon header keys likely to be sent by the peer, while not
43+
+ // so high as to permit unreaasonable memory usage if the peer sends an unbounded
44+
+ // number of unique header keys.
45+
+ const maxCachedCanonicalHeaders = 32
46+
+ if len(sc.canonHeader) < maxCachedCanonicalHeaders {
47+
+ sc.canonHeader[v] = cv
48+
+ }
49+
return cv
50+
}
51+

‎SPECS/rook/rook.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
Summary: Orchestrator for distributed storage systems in cloud-native environments
2020
Name: rook
2121
Version: 1.6.2
22-
Release: 18%{?dist}
22+
Release: 19%{?dist}
2323
License: Apache-2.0
2424
Vendor: Microsoft Corporation
2525
Distribution: Mariner
@@ -56,6 +56,7 @@ Patch0: flexvolume-dir.patch
5656
# Can be removed if we upgrade to prometheus-node-exporter 1.10.0 or later.
5757
Patch1: CVE-2022-21698.patch
5858
Patch2: CVE-2023-44487.patch
59+
Patch3: CVE-2021-44716.patch
5960
# Ceph version is needed to set correct container tag in manifests
6061
BuildRequires: ceph
6162
# Rook requirements
@@ -254,6 +255,9 @@ sed -i -e "s|\(.*tag: \)VERSION|\1%{helm_appVersion}|" %{values_yaml}
254255
# bother adding docs or changelog or anything
255256

256257
%changelog
258+
* Tue Feb 13 2024 Nan Liu <liunan@microsoft.com> - 1.6.2-19
259+
- Patch CVE-2021-44716
260+
257261
* Fri Feb 09 2024 Muhammad Falak <mwani@microsoft.com> - 1.6.2-18
258262
- Bump release to rebuild with go 1.21.6
259263

0 commit comments

Comments
 (0)