From e454712b58da1b9ac83b5ea9b0e267726ba20c7d Mon Sep 17 00:00:00 2001 From: Kanishk Bansal Date: Wed, 29 Jan 2025 19:53:34 +0000 Subject: [PATCH] Address CVE-2024-28180 for moby-containerd-cc --- SPECS/moby-containerd-cc/CVE-2024-28180.patch | 88 +++++++++++++++++++ .../moby-containerd-cc.spec | 6 +- 2 files changed, 93 insertions(+), 1 deletion(-) create mode 100644 SPECS/moby-containerd-cc/CVE-2024-28180.patch diff --git a/SPECS/moby-containerd-cc/CVE-2024-28180.patch b/SPECS/moby-containerd-cc/CVE-2024-28180.patch new file mode 100644 index 00000000000..ea1e8aac18b --- /dev/null +++ b/SPECS/moby-containerd-cc/CVE-2024-28180.patch @@ -0,0 +1,88 @@ +From ab8b0b446f76a316dc942973c601b0dda2e50843 Mon Sep 17 00:00:00 2001 +From: Kanishk Bansal +Date: Wed, 29 Jan 2025 19:50:52 +0000 +Subject: [PATCH] Address CVE-2024-28180 for moby-containerd-cc + +--- + vendor/gopkg.in/square/go-jose.v2/crypter.go | 6 ++++++ + vendor/gopkg.in/square/go-jose.v2/encoding.go | 20 +++++++++++++++---- + 2 files changed, 22 insertions(+), 4 deletions(-) + +diff --git a/vendor/gopkg.in/square/go-jose.v2/crypter.go b/vendor/gopkg.in/square/go-jose.v2/crypter.go +index d24cabf..a628386 100644 +--- a/vendor/gopkg.in/square/go-jose.v2/crypter.go ++++ b/vendor/gopkg.in/square/go-jose.v2/crypter.go +@@ -405,6 +405,9 @@ func (ctx *genericEncrypter) Options() EncrypterOptions { + // Decrypt and validate the object and return the plaintext. Note that this + // function does not support multi-recipient, if you desire multi-recipient + // decryption use DecryptMulti instead. ++// ++// Automatically decompresses plaintext, but returns an error if the decompressed ++// data would be >250kB or >10x the size of the compressed data, whichever is larger. + func (obj JSONWebEncryption) Decrypt(decryptionKey interface{}) ([]byte, error) { + headers := obj.mergedHeaders(nil) + +@@ -469,6 +472,9 @@ func (obj JSONWebEncryption) Decrypt(decryptionKey interface{}) ([]byte, error) + // with support for multiple recipients. It returns the index of the recipient + // for which the decryption was successful, the merged headers for that recipient, + // and the plaintext. ++// ++// Automatically decompresses plaintext, but returns an error if the decompressed ++// data would be >250kB or >3x the size of the compressed data, whichever is larger. + func (obj JSONWebEncryption) DecryptMulti(decryptionKey interface{}) (int, Header, []byte, error) { + globalHeaders := obj.mergedHeaders(nil) + +diff --git a/vendor/gopkg.in/square/go-jose.v2/encoding.go b/vendor/gopkg.in/square/go-jose.v2/encoding.go +index 70f7385..2b92116 100644 +--- a/vendor/gopkg.in/square/go-jose.v2/encoding.go ++++ b/vendor/gopkg.in/square/go-jose.v2/encoding.go +@@ -21,6 +21,7 @@ import ( + "compress/flate" + "encoding/base64" + "encoding/binary" ++ "fmt" + "io" + "math/big" + "strings" +@@ -85,7 +86,7 @@ func decompress(algorithm CompressionAlgorithm, input []byte) ([]byte, error) { + } + } + +-// Compress with DEFLATE ++// deflate compresses the input. + func deflate(input []byte) ([]byte, error) { + output := new(bytes.Buffer) + +@@ -97,15 +98,26 @@ func deflate(input []byte) ([]byte, error) { + return output.Bytes(), err + } + +-// Decompress with DEFLATE ++// inflate decompresses the input. ++// ++// Errors if the decompressed data would be >250kB or >10x the size of the ++// compressed data, whichever is larger. + func inflate(input []byte) ([]byte, error) { + output := new(bytes.Buffer) + reader := flate.NewReader(bytes.NewBuffer(input)) + +- _, err := io.Copy(output, reader) +- if err != nil { ++ maxCompressedSize := 10 * int64(len(input)) ++ if maxCompressedSize < 250000 { ++ maxCompressedSize = 250000 ++ } ++ limit := maxCompressedSize + 1 ++ n, err := io.CopyN(output, reader, limit) ++ if err != nil && err != io.EOF { + return nil, err + } ++ if n == limit { ++ return nil, fmt.Errorf("uncompressed data would be too large (>%d bytes)", maxCompressedSize) ++ } + + err = reader.Close() + return output.Bytes(), err +-- +2.43.0 + diff --git a/SPECS/moby-containerd-cc/moby-containerd-cc.spec b/SPECS/moby-containerd-cc/moby-containerd-cc.spec index e1075be8d25..831f5ce255e 100644 --- a/SPECS/moby-containerd-cc/moby-containerd-cc.spec +++ b/SPECS/moby-containerd-cc/moby-containerd-cc.spec @@ -6,7 +6,7 @@ Summary: Industry-standard container runtime for confidential containers Name: moby-%{upstream_name} Version: 1.7.7 -Release: 8%{?dist} +Release: 9%{?dist} License: ASL 2.0 Group: Tools/Container URL: https://www.containerd.io @@ -21,6 +21,7 @@ Patch1: CVE-2023-44487.patch Patch2: fix_cc_tests_for_golang1.21.patch Patch4: CVE-2023-45288.patch Patch5: CVE-2024-24786.patch +Patch6: CVE-2024-28180.patch %{?systemd_requires} @@ -81,6 +82,9 @@ fi %config(noreplace) %{_sysconfdir}/containerd/config.toml %changelog +* Thu Jan 30 2025 Kanishk Bansal - 1.7.7-9 +- Fix CVE-2024-28180 with an upstream patch + * Thu Dec 05 2024 sthelkar - 1.7.7-8 - Patch CVE-2024-24786