Skip to content

Commit c7c8c86

Browse files
xorduxxordux
authored
Fix multiple CVEs in Skopeo (#10998)
1 parent 3272f2f commit c7c8c86

File tree

4 files changed

+350
-1
lines changed

4 files changed

+350
-1
lines changed

‎SPECS/skopeo/CVE-2024-24786.patch‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
From 8b21f5b64ee714e4ada48a03bf8ca5f2cfb065ca Mon Sep 17 00:00:00 2001
2+
From: Rohit Rawat <[email protected]>
3+
Date: Sun, 10 Nov 2024 17:20:59 +0000
4+
Subject: [PATCH] encoding/protojson, internal/encoding/json: handle missing
5+
object values
6+
7+
Patch from https://go-review.googlesource.com/c/protobuf/+/569356 by Damien Neil <[email protected]>
8+
---
9+
.../protobuf/encoding/protojson/well_known_types.go | 4 ++++
10+
.../protobuf/internal/encoding/json/decode.go | 2 +-
11+
2 files changed, 5 insertions(+), 1 deletion(-)
12+
13+
diff --git a/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go b/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
14+
index 6c37d41..d5a6b1f 100644
15+
--- a/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
16+
+++ b/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
17+
@@ -328,6 +328,10 @@ func (d decoder) skipJSONValue() error {
18+
if err := d.skipJSONValue(); err != nil {
19+
return err
20+
}
21+
+ case json.EOF:
22+
+ // This can only happen if there's a bug in Decoder.Read.
23+
+ // Avoid an infinite loop if this does happen.
24+
+ return errors.New("unexpected EOF")
25+
}
26+
}
27+
28+
diff --git a/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go b/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
29+
index d043a6e..d2b3ac0 100644
30+
--- a/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
31+
+++ b/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
32+
@@ -121,7 +121,7 @@ func (d *Decoder) Read() (Token, error) {
33+
34+
case ObjectClose:
35+
if len(d.openStack) == 0 ||
36+
- d.lastToken.kind == comma ||
37+
+ d.lastToken.kind&(Name|comma) != 0 ||
38+
d.openStack[len(d.openStack)-1] != ObjectOpen {
39+
return Token{}, d.newSyntaxError(tok.pos, unexpectedFmt, tok.RawString())
40+
}
41+
--
42+
2.39.4
43+

‎SPECS/skopeo/CVE-2024-28180.patch‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
From 0849cf7e3480031bdf508f44b339a8a65baabd38 Mon Sep 17 00:00:00 2001
2+
From: Rohit Rawat <[email protected]>
3+
Date: Mon, 11 Nov 2024 09:10:52 +0000
4+
Subject: [PATCH] backport decompression limit fix
5+
6+
Patch from: PR #107 and #109 in https://github.com/go-jose/go-jose by Jacob Hoffman-Andrews <[email protected]>
7+
---
8+
.../github.com/go-jose/go-jose/v3/encoding.go | 21 +++++++++++++++----
9+
.../gopkg.in/go-jose/go-jose.v2/encoding.go | 21 +++++++++++++++----
10+
2 files changed, 34 insertions(+), 8 deletions(-)
11+
12+
diff --git a/vendor/github.com/go-jose/go-jose/v3/encoding.go b/vendor/github.com/go-jose/go-jose/v3/encoding.go
13+
index 968a424..e2c003a 100644
14+
--- a/vendor/github.com/go-jose/go-jose/v3/encoding.go
15+
+++ b/vendor/github.com/go-jose/go-jose/v3/encoding.go
16+
@@ -21,6 +21,7 @@ import (
17+
"compress/flate"
18+
"encoding/base64"
19+
"encoding/binary"
20+
+ "fmt"
21+
"io"
22+
"math/big"
23+
"strings"
24+
@@ -85,7 +86,7 @@ func decompress(algorithm CompressionAlgorithm, input []byte) ([]byte, error) {
25+
}
26+
}
27+
28+
-// Compress with DEFLATE
29+
+// deflate compresses the input.
30+
func deflate(input []byte) ([]byte, error) {
31+
output := new(bytes.Buffer)
32+
33+
@@ -97,15 +98,27 @@ func deflate(input []byte) ([]byte, error) {
34+
return output.Bytes(), err
35+
}
36+
37+
-// Decompress with DEFLATE
38+
+// inflate decompresses the input.
39+
+//
40+
+// Errors if the decompressed data would be >250kB or >10x the size of the
41+
+// compressed data, whichever is larger.
42+
func inflate(input []byte) ([]byte, error) {
43+
output := new(bytes.Buffer)
44+
reader := flate.NewReader(bytes.NewBuffer(input))
45+
46+
- _, err := io.Copy(output, reader)
47+
- if err != nil {
48+
+ maxCompressedSize := 10 * int64(len(input))
49+
+ if maxCompressedSize < 250000 {
50+
+ maxCompressedSize = 250000
51+
+ }
52+
+
53+
+ limit := maxCompressedSize + 1
54+
+ n, err := io.CopyN(output, reader, limit)
55+
+ if err != nil && err != io.EOF {
56+
return nil, err
57+
}
58+
+ if n == limit {
59+
+ return nil, fmt.Errorf("uncompressed data would be too large (>%d bytes)", maxCompressedSize)
60+
+ }
61+
62+
err = reader.Close()
63+
return output.Bytes(), err
64+
diff --git a/vendor/gopkg.in/go-jose/go-jose.v2/encoding.go b/vendor/gopkg.in/go-jose/go-jose.v2/encoding.go
65+
index 40b688b..636f6c8 100644
66+
--- a/vendor/gopkg.in/go-jose/go-jose.v2/encoding.go
67+
+++ b/vendor/gopkg.in/go-jose/go-jose.v2/encoding.go
68+
@@ -21,6 +21,7 @@ import (
69+
"compress/flate"
70+
"encoding/base64"
71+
"encoding/binary"
72+
+ "fmt"
73+
"io"
74+
"math/big"
75+
"strings"
76+
@@ -85,7 +86,7 @@ func decompress(algorithm CompressionAlgorithm, input []byte) ([]byte, error) {
77+
}
78+
}
79+
80+
-// Compress with DEFLATE
81+
+// deflate compresses the input.
82+
func deflate(input []byte) ([]byte, error) {
83+
output := new(bytes.Buffer)
84+
85+
@@ -97,15 +98,27 @@ func deflate(input []byte) ([]byte, error) {
86+
return output.Bytes(), err
87+
}
88+
89+
-// Decompress with DEFLATE
90+
+// inflate decompresses the input.
91+
+//
92+
+// Errors if the decompressed data would be >250kB or >10x the size of the
93+
+// compressed data, whichever is larger.
94+
func inflate(input []byte) ([]byte, error) {
95+
output := new(bytes.Buffer)
96+
reader := flate.NewReader(bytes.NewBuffer(input))
97+
98+
- _, err := io.Copy(output, reader)
99+
- if err != nil {
100+
+ maxCompressedSize := 10 * int64(len(input))
101+
+ if maxCompressedSize < 250000 {
102+
+ maxCompressedSize = 250000
103+
+ }
104+
+
105+
+ limit := maxCompressedSize + 1
106+
+ n, err := io.CopyN(output, reader, limit)
107+
+ if err != nil && err != io.EOF {
108+
return nil, err
109+
}
110+
+ if n == limit {
111+
+ return nil, fmt.Errorf("uncompressed data would be too large (>%d bytes)", maxCompressedSize)
112+
+ }
113+
114+
err = reader.Close()
115+
return output.Bytes(), err
116+
--
117+
2.39.4
118+

‎SPECS/skopeo/CVE-2024-9676.patch‎

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
From d461620d47450c72d9f0da215606949272df3398 Mon Sep 17 00:00:00 2001
2+
From: Rohit Rawat <[email protected]>
3+
Date: Sun, 10 Nov 2024 18:36:17 +0000
4+
Subject: [PATCH] Backport CVE-2024-9676 fix
5+
6+
Patch from https://github.com/containers/storage/pull/2146 by Matt Heon <[email protected]>
7+
---
8+
.../github.com/containers/storage/.cirrus.yml | 2 +-
9+
.../github.com/containers/storage/userns.go | 92 +++++++++++++------
10+
.../containers/storage/userns_unsupported.go | 14 +++
11+
3 files changed, 80 insertions(+), 28 deletions(-)
12+
create mode 100644 vendor/github.com/containers/storage/userns_unsupported.go
13+
14+
diff --git a/vendor/github.com/containers/storage/.cirrus.yml b/vendor/github.com/containers/storage/.cirrus.yml
15+
index c41dd5d..9e61509 100644
16+
--- a/vendor/github.com/containers/storage/.cirrus.yml
17+
+++ b/vendor/github.com/containers/storage/.cirrus.yml
18+
@@ -119,7 +119,7 @@ lint_task:
19+
env:
20+
CIRRUS_WORKING_DIR: "/go/src/github.com/containers/storage"
21+
container:
22+
- image: golang
23+
+ image: golang:1.19
24+
modules_cache:
25+
fingerprint_script: cat go.sum
26+
folder: $GOPATH/pkg/mod
27+
diff --git a/vendor/github.com/containers/storage/userns.go b/vendor/github.com/containers/storage/userns.go
28+
index 32ae830..2c855da 100644
29+
--- a/vendor/github.com/containers/storage/userns.go
30+
+++ b/vendor/github.com/containers/storage/userns.go
31+
@@ -1,18 +1,21 @@
32+
+//go:build linux
33+
+
34+
package storage
35+
36+
import (
37+
"fmt"
38+
"os"
39+
"os/user"
40+
- "path/filepath"
41+
"strconv"
42+
43+
drivers "github.com/containers/storage/drivers"
44+
"github.com/containers/storage/pkg/idtools"
45+
"github.com/containers/storage/pkg/unshare"
46+
"github.com/containers/storage/types"
47+
+ securejoin "github.com/cyphar/filepath-securejoin"
48+
libcontainerUser "github.com/opencontainers/runc/libcontainer/user"
49+
"github.com/sirupsen/logrus"
50+
+ "golang.org/x/sys/unix"
51+
)
52+
53+
// getAdditionalSubIDs looks up the additional IDs configured for
54+
@@ -85,40 +88,59 @@ const nobodyUser = 65534
55+
// parseMountedFiles returns the maximum UID and GID found in the /etc/passwd and
56+
// /etc/group files.
57+
func parseMountedFiles(containerMount, passwdFile, groupFile string) uint32 {
58+
+ var (
59+
+ passwd *os.File
60+
+ group *os.File
61+
+ size int
62+
+ err error
63+
+ )
64+
if passwdFile == "" {
65+
- passwdFile = filepath.Join(containerMount, "etc/passwd")
66+
- }
67+
- if groupFile == "" {
68+
- groupFile = filepath.Join(groupFile, "etc/group")
69+
+ passwd, err = secureOpen(containerMount, "/etc/passwd")
70+
+ } else {
71+
+ // User-specified override from a volume. Will not be in
72+
+ // container root.
73+
+ passwd, err = os.Open(passwdFile)
74+
}
75+
-
76+
- size := 0
77+
-
78+
- users, err := libcontainerUser.ParsePasswdFile(passwdFile)
79+
if err == nil {
80+
- for _, u := range users {
81+
- // Skip the "nobody" user otherwise we end up with 65536
82+
- // ids with most images
83+
- if u.Name == "nobody" {
84+
- continue
85+
- }
86+
- if u.Uid > size && u.Uid != nobodyUser {
87+
- size = u.Uid
88+
- }
89+
- if u.Gid > size && u.Gid != nobodyUser {
90+
- size = u.Gid
91+
+ defer passwd.Close()
92+
+
93+
+ users, err := libcontainerUser.ParsePasswd(passwd)
94+
+ if err == nil {
95+
+ for _, u := range users {
96+
+ // Skip the "nobody" user otherwise we end up with 65536
97+
+ // ids with most images
98+
+ if u.Name == "nobody" || u.Name == "nogroup" {
99+
+ continue
100+
+ }
101+
+ if u.Uid > size && u.Uid != nobodyUser {
102+
+ size = u.Uid + 1
103+
+ }
104+
+ if u.Gid > size && u.Gid != nobodyUser {
105+
+ size = u.Gid + 1
106+
+ }
107+
}
108+
}
109+
}
110+
111+
- groups, err := libcontainerUser.ParseGroupFile(groupFile)
112+
+ if groupFile == "" {
113+
+ group, err = secureOpen(containerMount, "/etc/group")
114+
+ } else {
115+
+ // User-specified override from a volume. Will not be in
116+
+ // container root.
117+
+ group, err = os.Open(groupFile)
118+
+ }
119+
if err == nil {
120+
- for _, g := range groups {
121+
- if g.Name == "nobody" {
122+
- continue
123+
- }
124+
- if g.Gid > size && g.Gid != nobodyUser {
125+
- size = g.Gid
126+
+ defer group.Close()
127+
+
128+
+ groups, err := libcontainerUser.ParseGroup(group)
129+
+ if err == nil {
130+
+ for _, g := range groups {
131+
+ if g.Name == "nobody" || g.Name == "nogroup" {
132+
+ continue
133+
+ }
134+
+ if g.Gid > size && g.Gid != nobodyUser {
135+
+ size = g.Gid + 1
136+
+ }
137+
}
138+
}
139+
}
140+
@@ -309,3 +331,19 @@ func getAutoUserNSIDMappings(
141+
gidMap := append(availableGIDs.zip(requestedContainerGIDs), additionalGIDMappings...)
142+
return uidMap, gidMap, nil
143+
}
144+
+
145+
+// Securely open (read-only) a file in a container mount.
146+
+func secureOpen(containerMount, file string) (*os.File, error) {
147+
+ filePath, err := securejoin.SecureJoin(containerMount, file)
148+
+ if err != nil {
149+
+ return nil, err
150+
+ }
151+
+
152+
+ flags := unix.O_PATH | unix.O_CLOEXEC | unix.O_RDONLY
153+
+ fileHandle, err := os.OpenFile(filePath, flags, 0)
154+
+ if err != nil {
155+
+ return nil, err
156+
+ }
157+
+
158+
+ return fileHandle, nil
159+
+}
160+
diff --git a/vendor/github.com/containers/storage/userns_unsupported.go b/vendor/github.com/containers/storage/userns_unsupported.go
161+
new file mode 100644
162+
index 0000000..e37c18f
163+
--- /dev/null
164+
+++ b/vendor/github.com/containers/storage/userns_unsupported.go
165+
@@ -0,0 +1,14 @@
166+
+//go:build !linux
167+
+
168+
+package storage
169+
+
170+
+import (
171+
+ "errors"
172+
+
173+
+ "github.com/containers/storage/pkg/idtools"
174+
+ "github.com/containers/storage/types"
175+
+)
176+
+
177+
+func (s *store) getAutoUserNS(_ *types.AutoUserNsOptions, _ *Image, _ rwLayerStore, _ []roLayerStore) ([]idtools.IDMap, []idtools.IDMap, error) {
178+
+ return nil, nil, errors.New("user namespaces are not supported on this platform")
179+
+}
180+
--
181+
2.39.4
182+

‎SPECS/skopeo/skopeo.spec‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Inspect container images and repositories on registries
22
Name: skopeo
33
Version: 1.14.2
4-
Release: 8%{?dist}
4+
Release: 9%{?dist}
55
License: Apache-2.0
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -11,6 +11,9 @@ Source0: https://github.com/containers/skopeo/archive/refs/tags/v%{versio
1111
Patch0: CVE-2023-45288.patch
1212
Patch1: CVE-2024-3727.patch
1313
Patch2: CVE-2024-6104.patch
14+
Patch3: CVE-2024-9676.patch
15+
Patch4: CVE-2024-28180.patch
16+
Patch5: CVE-2024-24786.patch
1417
%global debug_package %{nil}
1518
%define our_gopath %{_topdir}/.gopath
1619
BuildRequires: btrfs-progs-devel
@@ -48,6 +51,9 @@ make test-unit-local
4851
%{_mandir}/man1/%%{name}*
4952

5053
%changelog
54+
* Mon Nov 11 2024 Rohit Rawat <[email protected]> - 1.14.2-9
55+
- Fix CVE-2024-9676, CVE-2024-28180 and CVE-2024-24786
56+
5157
* Mon Sep 09 2024 CBL-Mariner Servicing Account <[email protected]> - 1.14.2-8
5258
- Bump release to rebuild with go 1.22.7
5359

0 commit comments

Comments
 (0)