nodejs: CVE-2023-35945 (#6180)
* add nghttp2 patch to nodejs and nodejs18 * fix versions * try fixing up patches * remove test files from patches
This commit is contained in:
bfjelds
GitHub
Родитель
b34b9b2bb3
Коммит
380a01c3b5
|
|
@ -0,0 +1,87 @@
|
|||
From 167335314e0e5a587fadf76287b26bf674e2a607 Mon Sep 17 00:00:00 2001
|
||||
From: Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
|
||||
Date: Fri, 14 Jul 2023 20:52:03 +0900
|
||||
Subject: [PATCH] Fix memory leak
|
||||
|
||||
This commit fixes memory leak that happens when PUSH_PROMISE or
|
||||
HEADERS frame cannot be sent, and nghttp2_on_stream_close_callback
|
||||
fails with a fatal error. For example, if GOAWAY frame has been
|
||||
received, a HEADERS frame that opens new stream cannot be sent.
|
||||
|
||||
This issue has already been made public via CVE-2023-35945 [1] issued
|
||||
by envoyproxy/envoy project. During embargo period, the patch to fix
|
||||
this bug was accidentally submitted to nghttp2/nghttp2 repository [2].
|
||||
And they decided to disclose CVE early. I was notified just 1.5 hours
|
||||
before disclosure. I had no time to respond.
|
||||
|
||||
PoC described in [1] is quite simple, but I think it is not enough to
|
||||
trigger this bug. While it is true that receiving GOAWAY prevents a
|
||||
client from opening new stream, and nghttp2 enters error handling
|
||||
branch, in order to cause the memory leak,
|
||||
nghttp2_session_close_stream function must return a fatal error.
|
||||
nghttp2 defines 2 fatal error codes:
|
||||
|
||||
- NGHTTP2_ERR_NOMEM
|
||||
- NGHTTP2_ERR_CALLBACK_FAILURE
|
||||
|
||||
NGHTTP2_ERR_NOMEM, as its name suggests, indicates out of memory. It
|
||||
is unlikely that a process gets short of memory with this simple PoC
|
||||
scenario unless application does something memory heavy processing.
|
||||
|
||||
NGHTTP2_ERR_CALLBACK_FAILURE is returned from application defined
|
||||
callback function (nghttp2_on_stream_close_callback, in this case),
|
||||
which indicates something fatal happened inside a callback, and a
|
||||
connection must be closed immediately without any further action. As
|
||||
nghttp2_on_stream_close_error_callback documentation says, any error
|
||||
code other than 0 or NGHTTP2_ERR_CALLBACK_FAILURE is treated as fatal
|
||||
error code. More specifically, it is treated as if
|
||||
NGHTTP2_ERR_CALLBACK_FAILURE is returned. I guess that envoy returns
|
||||
NGHTTP2_ERR_CALLBACK_FAILURE or other error code which is translated
|
||||
into NGHTTP2_ERR_CALLBACK_FAILURE.
|
||||
|
||||
[1] https://github.com/envoyproxy/envoy/security/advisories/GHSA-jfxv-29pc-x22r
|
||||
[2] https://github.com/nghttp2/nghttp2/pull/1929
|
||||
---
|
||||
lib/nghttp2_session.c | 10 +++++-----
|
||||
tests/nghttp2_session_test.c | 34 ++++++++++++++++++++++++++++++++++
|
||||
2 files changed, 39 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/deps/nghttp2/lib/nghttp2_session.c b/deps/nghttp2/lib/nghttp2_session.c
|
||||
index 93f3f07c..9bb32b2c 100644
|
||||
--- a/deps/nghttp2/lib/nghttp2_session.c
|
||||
+++ b/deps/nghttp2/lib/nghttp2_session.c
|
||||
@@ -3300,6 +3300,7 @@ static ssize_t nghttp2_session_mem_send_internal(nghttp2_session *session,
|
||||
if (rv < 0) {
|
||||
int32_t opened_stream_id = 0;
|
||||
uint32_t error_code = NGHTTP2_INTERNAL_ERROR;
|
||||
+ int rv2 = 0;
|
||||
|
||||
DEBUGF("send: frame preparation failed with %s\n",
|
||||
nghttp2_strerror(rv));
|
||||
@@ -3342,19 +3343,18 @@ static ssize_t nghttp2_session_mem_send_internal(nghttp2_session *session,
|
||||
}
|
||||
if (opened_stream_id) {
|
||||
/* careful not to override rv */
|
||||
- int rv2;
|
||||
rv2 = nghttp2_session_close_stream(session, opened_stream_id,
|
||||
error_code);
|
||||
-
|
||||
- if (nghttp2_is_fatal(rv2)) {
|
||||
- return rv2;
|
||||
- }
|
||||
}
|
||||
|
||||
nghttp2_outbound_item_free(item, mem);
|
||||
nghttp2_mem_free(mem, item);
|
||||
active_outbound_item_reset(aob, mem);
|
||||
|
||||
+ if (nghttp2_is_fatal(rv2)) {
|
||||
+ return rv2;
|
||||
+ }
|
||||
+
|
||||
if (rv == NGHTTP2_ERR_HEADER_COMP) {
|
||||
/* If header compression error occurred, should terminiate
|
||||
connection. */
|
||||
--
|
||||
2.17.1
|
||||
|
||||
|
|
@ -0,0 +1,87 @@
|
|||
From 5dc13a41fea5804e5b28478fa6cd07f31604965c Mon Sep 17 00:00:00 2001
|
||||
From: Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
|
||||
Date: Fri, 14 Jul 2023 20:52:03 +0900
|
||||
Subject: [PATCH] Fix memory leak
|
||||
|
||||
This commit fixes memory leak that happens when PUSH_PROMISE or
|
||||
HEADERS frame cannot be sent, and nghttp2_on_stream_close_callback
|
||||
fails with a fatal error. For example, if GOAWAY frame has been
|
||||
received, a HEADERS frame that opens new stream cannot be sent.
|
||||
|
||||
This issue has already been made public via CVE-2023-35945 [1] issued
|
||||
by envoyproxy/envoy project. During embargo period, the patch to fix
|
||||
this bug was accidentally submitted to nghttp2/nghttp2 repository [2].
|
||||
And they decided to disclose CVE early. I was notified just 1.5 hours
|
||||
before disclosure. I had no time to respond.
|
||||
|
||||
PoC described in [1] is quite simple, but I think it is not enough to
|
||||
trigger this bug. While it is true that receiving GOAWAY prevents a
|
||||
client from opening new stream, and nghttp2 enters error handling
|
||||
branch, in order to cause the memory leak,
|
||||
nghttp2_session_close_stream function must return a fatal error.
|
||||
nghttp2 defines 2 fatal error codes:
|
||||
|
||||
- NGHTTP2_ERR_NOMEM
|
||||
- NGHTTP2_ERR_CALLBACK_FAILURE
|
||||
|
||||
NGHTTP2_ERR_NOMEM, as its name suggests, indicates out of memory. It
|
||||
is unlikely that a process gets short of memory with this simple PoC
|
||||
scenario unless application does something memory heavy processing.
|
||||
|
||||
NGHTTP2_ERR_CALLBACK_FAILURE is returned from application defined
|
||||
callback function (nghttp2_on_stream_close_callback, in this case),
|
||||
which indicates something fatal happened inside a callback, and a
|
||||
connection must be closed immediately without any further action. As
|
||||
nghttp2_on_stream_close_error_callback documentation says, any error
|
||||
code other than 0 or NGHTTP2_ERR_CALLBACK_FAILURE is treated as fatal
|
||||
error code. More specifically, it is treated as if
|
||||
NGHTTP2_ERR_CALLBACK_FAILURE is returned. I guess that envoy returns
|
||||
NGHTTP2_ERR_CALLBACK_FAILURE or other error code which is translated
|
||||
into NGHTTP2_ERR_CALLBACK_FAILURE.
|
||||
|
||||
[1] https://github.com/envoyproxy/envoy/security/advisories/GHSA-jfxv-29pc-x22r
|
||||
[2] https://github.com/nghttp2/nghttp2/pull/1929
|
||||
---
|
||||
lib/nghttp2_session.c | 10 +++++-----
|
||||
tests/nghttp2_session_test.c | 34 ++++++++++++++++++++++++++++++++++
|
||||
2 files changed, 39 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/deps/nghttp2/lib/nghttp2_session.c b/deps/nghttp2/lib/nghttp2_session.c
|
||||
index 380a47c1..2d9285f4 100644
|
||||
--- a/deps/nghttp2/lib/nghttp2_session.c
|
||||
+++ b/deps/nghttp2/lib/nghttp2_session.c
|
||||
@@ -2940,6 +2940,7 @@ static ssize_t nghttp2_session_mem_send_internal(nghttp2_session *session,
|
||||
if (rv < 0) {
|
||||
int32_t opened_stream_id = 0;
|
||||
uint32_t error_code = NGHTTP2_INTERNAL_ERROR;
|
||||
+ int rv2 = 0;
|
||||
|
||||
DEBUGF("send: frame preparation failed with %s\n",
|
||||
nghttp2_strerror(rv));
|
||||
@@ -2982,19 +2983,18 @@ static ssize_t nghttp2_session_mem_send_internal(nghttp2_session *session,
|
||||
}
|
||||
if (opened_stream_id) {
|
||||
/* careful not to override rv */
|
||||
- int rv2;
|
||||
rv2 = nghttp2_session_close_stream(session, opened_stream_id,
|
||||
error_code);
|
||||
-
|
||||
- if (nghttp2_is_fatal(rv2)) {
|
||||
- return rv2;
|
||||
- }
|
||||
}
|
||||
|
||||
nghttp2_outbound_item_free(item, mem);
|
||||
nghttp2_mem_free(mem, item);
|
||||
active_outbound_item_reset(aob, mem);
|
||||
|
||||
+ if (nghttp2_is_fatal(rv2)) {
|
||||
+ return rv2;
|
||||
+ }
|
||||
+
|
||||
if (rv == NGHTTP2_ERR_HEADER_COMP) {
|
||||
/* If header compression error occurred, should terminiate
|
||||
connection. */
|
||||
--
|
||||
2.17.1
|
||||
|
||||
|
|
@ -5,7 +5,7 @@ Name: nodejs
|
|||
# WARNINGS: MUST check and update the 'npm_version' macro for every version update of this package.
|
||||
# The version of NPM can be found inside the sources under 'deps/npm/package.json'.
|
||||
Version: 16.20.2
|
||||
Release: 1%{?dist}
|
||||
Release: 2%{?dist}
|
||||
License: BSD AND MIT AND Public Domain AND NAIST-2003 AND Artistic-2.0
|
||||
Vendor: Microsoft Corporation
|
||||
Distribution: Mariner
|
||||
|
|
@ -17,6 +17,7 @@ URL: https://github.com/nodejs/node
|
|||
Source0: https://nodejs.org/download/release/v%{version}/node-v%{version}.tar.xz
|
||||
Patch0: disable-tlsv1-tlsv1-1.patch
|
||||
Patch1: CVE-2022-25883.patch
|
||||
Patch2: CVE-2023-35945.patch
|
||||
BuildRequires: brotli-devel
|
||||
BuildRequires: c-ares-devel
|
||||
BuildRequires: coreutils >= 8.22
|
||||
|
|
@ -114,6 +115,9 @@ make cctest
|
|||
%{_datadir}/systemtap/tapset/node.stp
|
||||
|
||||
%changelog
|
||||
* Wed Sep 06 2023 Brian Fjeldstad <bfjelds@microsoft.com> - 16.20.2-2
|
||||
- Patch CVE-2023-35945
|
||||
|
||||
* Wed Sep 06 2023 Brian Fjeldstad <bfjelds@microsoft.com> - 16.20.2-1
|
||||
- Patch CVE-2023-32002 CVE-2023-32006 CVE-2023-32559
|
||||
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ Name: nodejs18
|
|||
# WARNINGS: MUST check and update the 'npm_version' macro for every version update of this package.
|
||||
# The version of NPM can be found inside the sources under 'deps/npm/package.json'.
|
||||
Version: 18.17.1
|
||||
Release: 1%{?dist}
|
||||
Release: 2%{?dist}
|
||||
License: BSD and MIT and Public Domain and NAIST-2003 and Artistic-2.0
|
||||
Group: Applications/System
|
||||
Vendor: Microsoft Corporation
|
||||
|
|
@ -18,6 +18,7 @@ URL: https://github.com/nodejs/node
|
|||
Source0: https://nodejs.org/download/release/v%{version}/node-v%{version}.tar.xz
|
||||
Patch0: disable-tlsv1-tlsv1-1.patch
|
||||
Patch1: CVE-2022-25883-v18.patch
|
||||
Patch2: CVE-2023-35945-v18.patch
|
||||
|
||||
BuildRequires: brotli-devel
|
||||
BuildRequires: coreutils >= 8.22
|
||||
|
|
@ -117,6 +118,9 @@ make cctest
|
|||
%{_datadir}/systemtap/tapset/node.stp
|
||||
|
||||
%changelog
|
||||
* Wed Sep 06 2023 Brian Fjeldstad <bfjelds@microsoft.com> - 18.17.1-2
|
||||
- Patch CVE-2023-35945
|
||||
|
||||
* Wed Sep 06 2023 Brian Fjeldstad <bfjelds@microsoft.com> - 18.17.1-1
|
||||
- Patch CVE-2023-32002 CVE-2023-32006 CVE-2023-32559
|
||||
- Refresh patch CVE-2022-25883-v18
|
||||
|
|
|
|||
Загрузка…
Ссылка в новой задаче