docker/patch/0275-backport-fix-CVE-2024-32473.patch
chenjiankun 65c2f7d283 backport: fix CVE-2024-32473
fix #I9HX2H

(cherry picked from commit d958cc81c9d6b18ecd2568727ed778de043d5fbe)
2024-05-08 17:10:00 +08:00

61 lines
2.6 KiB
Diff

From ed5ed46f0aee11f3e4e0fcc2b2ce391460bd4550 Mon Sep 17 00:00:00 2001
From: chenjiankun <chenjiankun1@huawei.com>
Date: Wed, 8 May 2024 10:03:36 +0800
Subject: [PATCH] docker: Disable IPv6 for endpoints in '--ipv6=false' networks
No IPAM IPv6 address is given to an interface in a network with
'--ipv6=false', but the kernel would assign a link-local address and,
in a macvlan/ipvlan network, the interface may get a SLAAC-assigned
address.
So, disable IPv6 on the interface to avoid that.
Signed-off-by: Rob Murray <rob.murray@docker.com>
Conflict:no
Reference:https://github.com/moby/moby/commit/7cef0d9cd1cf221d8c0b7b7aeda69552649e0642
---
.../docker/libnetwork/osl/interface_linux.go | 21 ++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/components/engine/vendor/github.com/docker/libnetwork/osl/interface_linux.go b/components/engine/vendor/github.com/docker/libnetwork/osl/interface_linux.go
index a924af4bd..63d0e5650 100644
--- a/components/engine/vendor/github.com/docker/libnetwork/osl/interface_linux.go
+++ b/components/engine/vendor/github.com/docker/libnetwork/osl/interface_linux.go
@@ -377,17 +377,24 @@ func setInterfaceIP(nlh *netlink.Handle, iface netlink.Link, i *nwIface) error {
}
func setInterfaceIPv6(nlh *netlink.Handle, iface netlink.Link, i *nwIface) error {
- if i.AddressIPv6() == nil {
+ addr := i.AddressIPv6()
+ // IPv6 must be enabled on the interface if and only if the network is
+ // IPv6-enabled. For an interface on an IPv4-only network, if IPv6 isn't
+ // disabled, the interface will be put into IPv6 multicast groups making
+ // it unexpectedly susceptible to NDP cache poisoning, route injection, etc.
+ // (At present, there will always be a pre-configured IPv6 address if the
+ // network is IPv6-enabled.)
+ if err := setIPv6(i.ns.path, i.DstName(), addr != nil); err != nil {
+ return fmt.Errorf("failed to configure ipv6: %v", err)
+ }
+ if addr == nil {
return nil
}
- if err := checkRouteConflict(nlh, i.AddressIPv6(), netlink.FAMILY_V6); err != nil {
+ if err := checkRouteConflict(nlh, addr, netlink.FAMILY_V6); err != nil {
return err
}
- if err := setIPv6(i.ns.path, i.DstName(), true); err != nil {
- return fmt.Errorf("failed to enable ipv6: %v", err)
- }
- ipAddr := &netlink.Addr{IPNet: i.AddressIPv6(), Label: "", Flags: syscall.IFA_F_NODAD}
- return nlh.AddrAdd(iface, ipAddr)
+ nlAddr := &netlink.Addr{IPNet: addr, Label: "", Flags: syscall.IFA_F_NODAD}
+ return nlh.AddrAdd(iface, nlAddr)
}
func setInterfaceLinkLocalIPs(nlh *netlink.Handle, iface netlink.Link, i *nwIface) error {
--
2.33.0