packages/containerd
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!42 [sync] PR-41: fix CVE-2022-31030

Browse Source 
### 1. Origin pull request:
https://gitee.com/src-openeuler/containerd/pulls/41

### 2. Original pull request related issue(s):
https://gitee.com/src-openeuler/containerd/issues/I5BLIU

### 3. Original pull request related commit(s):
| Sha | Datetime | Message |
|---|---|---|
|[0436d058](0436d058b3)|2022-07-04 17:06:29 +0800 CST|containerd: Limit the response size of ExecSync<br><br>fix CVE-2022-31030<br><br>Signed-off-by: zhongjiawei <zhongjiawei1@huawei.com><br>|
 
From: @openeuler-sync-bot 
Reviewed-by: @zhangsong234, @duguhaotian 
Signed-off-by: @duguhaotian
This commit is contained in:
openeuler-ci-bot 2022-07-04 11:17:25 +00:00 committed by Gitee
commit 8f8cc81338
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
4 changed files with 142 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
containerd.spec
View File

@ -2,7 +2,7 @@
%global debug_package %{nil}
Version: 1.2.0
Name: containerd
Release: 302
Release: 303
Summary: An industry-standard container runtime
License: ASL 2.0
URL: https://containerd.io
@ -52,6 +52,12 @@ install -p -m 755 bin/containerd-shim $RPM_BUILD_ROOT/%{_bindir}/containerd-shim
%{_bindir}/containerd-shim
%changelog
* Mon Jul 4 2022 zhongjiawei<zhongjiawei1@huawei.com> - 1.2.0-303
- Type:bugfix
- ID:NA
- SUG:NA
- DESC: Limit the response size of ExecSync to fix CVE-2022-31030
* Wed Jun 22 2022 zhangsong234<zhangsong34@huawei.com> - 1.2.0-302
- Type:bugfix
- ID:NA

2
git-commit
View File

@ -1 +1 @@
755bdc7a74588295ea632aa10da179cbcce8c64f
1493659ef0808b8f3a5b920b0f0661833af2782e

133
patch/0086-containerd-Limit-the-response-size-of-ExecSync.patch Normal file
View File

@ -0,0 +1,133 @@
From cf3bde2b5a78d7ba8773eadcc3b28dfb0001aee0 Mon Sep 17 00:00:00 2001
From: zhongjiawei <zhongjiawei1@huawei.com>
Date: Mon, 4 Jul 2022 14:34:23 +0800
Subject: [PATCH] containerd: Limit the response size of ExecSync
fix CVE-2022-31030
upstream:https://github.com/containerd/containerd/commit/c1bcabb4541930f643aa36a2b38655e131346382
---
.../cri/pkg/server/container_execsync.go | 45 ++++++++++++++++-
.../cri/pkg/server/container_execsync_test.go | 49 +++++++++++++++++++
2 files changed, 92 insertions(+), 2 deletions(-)
create mode 100644 vendor/github.com/containerd/cri/pkg/server/container_execsync_test.go
diff --git a/vendor/github.com/containerd/cri/pkg/server/container_execsync.go b/vendor/github.com/containerd/cri/pkg/server/container_execsync.go
index fd54120..1ef93e5 100644
--- a/vendor/github.com/containerd/cri/pkg/server/container_execsync.go
+++ b/vendor/github.com/containerd/cri/pkg/server/container_execsync.go
@@ -37,14 +37,55 @@ import (
"github.com/containerd/cri/pkg/util"
)
+type cappedWriter struct {
+ w io.WriteCloser
+ remain int
+}
+
+func (cw *cappedWriter) Write(p []byte) (int, error) {
+ if cw.remain <= 0 {
+ return len(p), nil
+ }
+
+ end := cw.remain
+ if end > len(p) {
+ end = len(p)
+ }
+ written, err := cw.w.Write(p[0:end])
+ cw.remain -= written
+
+ if err != nil {
+ return written, err
+ }
+ return len(p), nil
+}
+
+func (cw *cappedWriter) Close() error {
+ return cw.w.Close()
+}
+
+func (cw *cappedWriter) isFull() bool {
+ return cw.remain <= 0
+}
+
// ExecSync executes a command in the container, and returns the stdout output.
// If command exits with a non-zero exit code, an error is returned.
func (c *criService) ExecSync(ctx context.Context, r *runtime.ExecSyncRequest) (*runtime.ExecSyncResponse, error) {
+ const maxStreamSize = 1024 * 1024 * 16
+
var stdout, stderr bytes.Buffer
+
+ // cappedWriter truncates the output. In that case, the size of
+ // the ExecSyncResponse will hit the CRI plugin's gRPC response limit.
+ // Thus the callers outside of the containerd process (e.g. Kubelet) never see
+ // the truncated output.
+ cout := &cappedWriter{w: cioutil.NewNopWriteCloser(&stdout), remain: maxStreamSize}
+ cerr := &cappedWriter{w: cioutil.NewNopWriteCloser(&stderr), remain: maxStreamSize}
+
exitCode, err := c.execInContainer(ctx, r.GetContainerId(), execOptions{
cmd: r.GetCmd(),
- stdout: cioutil.NewNopWriteCloser(&stdout),
- stderr: cioutil.NewNopWriteCloser(&stderr),
+ stdout: cout,
+ stderr: cerr,
timeout: time.Duration(r.GetTimeout()) * time.Second,
})
if err != nil {
diff --git a/vendor/github.com/containerd/cri/pkg/server/container_execsync_test.go b/vendor/github.com/containerd/cri/pkg/server/container_execsync_test.go
new file mode 100644
index 0000000..c8641d0
--- /dev/null
+++ b/vendor/github.com/containerd/cri/pkg/server/container_execsync_test.go
@@ -0,0 +1,49 @@
+/*
+ Copyright The containerd Authors.
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
+
+package server
+
+import (
+ "bytes"
+ "testing"
+
+ cioutil "github.com/containerd/containerd/pkg/ioutil"
+ "github.com/stretchr/testify/assert"
+)
+
+func TestCWWrite(t *testing.T) {
+ var buf bytes.Buffer
+ cw := &cappedWriter{w: cioutil.NewNopWriteCloser(&buf), remain: 10}
+
+ n, err := cw.Write([]byte("hello"))
+ assert.NoError(t, err)
+ assert.Equal(t, 5, n)
+
+ n, err = cw.Write([]byte("helloworld"))
+ assert.NoError(t, err, "no errors even it hits the cap")
+ assert.Equal(t, 10, n, "no indication of partial write")
+ assert.True(t, cw.isFull())
+ assert.Equal(t, []byte("hellohello"), buf.Bytes(), "the underlying writer is capped")
+
+ _, err = cw.Write([]byte("world"))
+ assert.NoError(t, err)
+ assert.True(t, cw.isFull())
+ assert.Equal(t, []byte("hellohello"), buf.Bytes(), "the underlying writer is capped")
+}
+
+func TestCWClose(t *testing.T) {
+ var buf bytes.Buffer
+ cw := &cappedWriter{w: cioutil.NewNopWriteCloser(&buf), remain: 5}
+ err := cw.Close()
+ assert.NoError(t, err)
+}
--
2.30.0

1
series.conf
View File

@ -90,4 +90,5 @@ patch/0082-containerd-fix-publish-command-wait-block-for.patch
patch/0083-containerd-optimize-cgo-compile-options.patch
patch/0084-containerd-Use-fs.RootPath-when-mounting-vo.patch
patch/0085-containerd-put-get-pid-lock-after-set-process-exited-to-.patch
patch/0086-containerd-Limit-the-response-size-of-ExecSync.patch
# end