734219a21a
go1.21.5 (released 2023-12-05) includes security fixes to the go command, and the net/http and path/filepath packages, as well as bug fixes to the compiler, the go command, the runtime, and the crypto/rand, net, os, and syscall packages. See the Go 1.21.5 milestone on our issue tracker for details: - https://github.com/golang/go/issues?q=milestone%3AGo1.21.5+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.21.4...go1.21.5 from the security mailing: [security] Go 1.21.5 and Go 1.20.12 are released Hello gophers, We have just released Go versions 1.21.5 and 1.20.12, minor point releases. These minor releases include 3 security fixes following the security policy: - net/http: limit chunked data overhead A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small. Thanks to Bartek Nowotarski for reporting this issue. This is CVE-2023-39326 and Go issue https://go.dev/issue/64433. - cmd/go: go get may unexpectedly fallback to insecure git Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off). Thanks to David Leadbeater for reporting this issue. This is CVE-2023-45285 and Go issue https://go.dev/issue/63845. - path/filepath: retain trailing \ when cleaning paths like \\?\c:\ Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?\, resulting in filepath.Clean(\\?\c:\) returning \\?\c: rather than \\?\c:\ (among other effects). The previous behavior has been restored. This is an update to CVE-2023-45283 and Go issue https://go.dev/issue/64028. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
105 lines
3.0 KiB
Bash
Executable File
105 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# Copyright The containerd Authors.
|
|
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
set -o nounset
|
|
set -o pipefail
|
|
set -o errexit
|
|
set -x
|
|
|
|
IFS=$'\n'
|
|
|
|
compile_fuzzers() {
|
|
local regex=$1
|
|
local compile_fuzzer=$2
|
|
local blocklist=$3
|
|
|
|
for line in $(git grep --full-name "$regex" | grep -v -E "$blocklist"); do
|
|
if [[ "$line" =~ (.*)/.*:.*(Fuzz[A-Za-z0-9]+) ]]; then
|
|
local pkg=${BASH_REMATCH[1]}
|
|
local func=${BASH_REMATCH[2]}
|
|
"$compile_fuzzer" "github.com/containerd/containerd/v2/$pkg" "$func" "fuzz_$func"
|
|
else
|
|
echo "failed to parse: $line"
|
|
exit 1
|
|
fi
|
|
done
|
|
}
|
|
|
|
# This is from https://github.com/AdamKorcz/instrumentation
|
|
cd $SRC/instrumentation
|
|
go run main.go $SRC/containerd/images
|
|
|
|
apt-get update && apt-get install -y wget
|
|
cd $SRC
|
|
wget --quiet https://go.dev/dl/go1.21.5.linux-amd64.tar.gz
|
|
|
|
mkdir temp-go
|
|
rm -rf /root/.go/*
|
|
tar -C temp-go/ -xzf go1.21.5.linux-amd64.tar.gz
|
|
mv temp-go/go/* /root/.go/
|
|
cd $SRC/containerd
|
|
|
|
go mod tidy
|
|
|
|
cd "$(dirname "${BASH_SOURCE[0]}")"
|
|
cd ../../
|
|
|
|
rm -r vendor
|
|
|
|
# Add temporary CXXFLAGS
|
|
OLDCXXFLAGS=$CXXFLAGS
|
|
export CXXFLAGS="$CXXFLAGS -lresolv"
|
|
|
|
# Change path of socket since OSS-fuzz does not grant access to /run
|
|
sed -i 's/\/run\/containerd/\/tmp\/containerd/g' $SRC/containerd/defaults/defaults_unix.go
|
|
|
|
compile_fuzzers '^func Fuzz.*testing\.F' compile_native_go_fuzzer vendor
|
|
compile_fuzzers '^func Fuzz.*data' compile_go_fuzzer '(vendor|Integ)'
|
|
|
|
# The below fuzzers require more setup than the fuzzers above.
|
|
# We need the binaries from "make".
|
|
wget --quiet https://github.com/protocolbuffers/protobuf/releases/download/v3.11.4/protoc-3.11.4-linux-x86_64.zip
|
|
unzip protoc-3.11.4-linux-x86_64.zip -d /usr/local
|
|
|
|
export CGO_ENABLED=1
|
|
export GOARCH=amd64
|
|
|
|
# Build runc
|
|
cd $SRC/
|
|
git clone https://github.com/opencontainers/runc --branch release-1.1
|
|
cd runc
|
|
make
|
|
make install
|
|
|
|
# Build static containerd
|
|
cd $SRC/containerd
|
|
make STATIC=1
|
|
|
|
mkdir $OUT/containerd-binaries || true
|
|
cd $SRC/containerd/bin && cp * $OUT/containerd-binaries/ && cd -
|
|
|
|
# Change defaultState and defaultAddress fron /run/containerd-test to /tmp/containerd-test:
|
|
sed -i 's/\/run\/containerd-test/\/tmp\/containerd-test/g' $SRC/containerd/integration/client/client_unix_test.go
|
|
|
|
cd integration/client
|
|
|
|
compile_fuzzers '^func FuzzInteg.*data' compile_go_fuzzer vendor
|
|
|
|
cp $SRC/containerd/contrib/fuzz/*.options $OUT/
|
|
cp $SRC/containerd/contrib/fuzz/*.dict $OUT/
|
|
|
|
# Resume CXXFLAGS
|
|
export CXXFLAGS=$OLDCXXFLAGS
|