net/http: ReadRequest can stack overflow due to recursion with very large headers

[katiehockman]

ReadRequest and ReadResponse in net/http can hit an unrecoverable panic when reading a very large header (over 7MB on 64-bit architectures, or over 4MB on 32-bit ones). Transport and Client are vulnerable and the program can be made to crash by a malicious server. Server is not vulnerable by default, but can be if the default max header of 1MB is overridden by setting Server.MaxHeaderBytes to a higher value, in which case the program can be made to crash by a malicious client.

This also affects golang.org/x/net/http2/h2c and HeaderValuesContainsToken in golang.org/x/net/http/httpguts, and is fixed in golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781.

This is CVE-2021-31525.

According to the new security policy (#44918), this will be fixed as a PUBLIC track issue.

Credit to Guido Vranken who reported the crash as part of the Ethereum 2.0 bounty program.

/cc @golang/security

[katiehockman]

@gopherbot please consider this for backport to 1.16.4 and 1.15.12, it's a security issue.

/cc @golang/release FYI

[gopherbot]

Backport issue(s) opened: #45711 (for 1.15), #45712 (for 1.16).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://golang.org/wiki/MinorReleases.

[gopherbot]

Change https://golang.org/cl/313069 mentions this issue: httpguts: remove recursion for HeaderValuesContainsToken

[gopherbot]

Change https://golang.org/cl/314596 mentions this issue: std: update golang.org/x/net to 20210428140749-89ef3d95e781

[gopherbot]

Change https://golang.org/cl/314649 mentions this issue: [internal-branch.go1.16-vendor

[gopherbot]

Change https://golang.org/cl/314650 mentions this issue: [release-branch.go1.15] http/httpguts: remove recursion in HeaderValuesContainsToken

[dmitshur]

The x/net fix still needs to be pulled into the main repo for Go 1.17 (which can be done individually like in CL 314596 or together with more x/net updates as part of #36905), reopening for that and adding release-blocker so it's not missed.