net/http: limit canonical header cache by bytes, not entries (CVE-2022-41717) #56350

neild · 2022-10-20T17:32:28Z

This is a PRIVATE issue for CVE-2022-41717 tracked in http://b/253471637.

net/http: limit canonical header cache by bytes, not entries

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests.

HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

This issue is also fixed in golang.org/x/net/http2 v0.4.0, for users manually configuring HTTP/2.

Thanks to Josselin Costanzi for reporting this issue.

neild · 2022-11-30T21:06:37Z

@gopherbot please open backport issues

gopherbot · 2022-11-30T21:06:49Z

Backport issue(s) opened: #57008 (for 1.18), #57009 (for 1.19).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

gopherbot · 2022-12-06T18:37:41Z

Change https://go.dev/cl/455361 mentions this issue: [release-branch.go1.18] net/http: update bundled golang.org/x/net/http2

gopherbot · 2022-12-06T18:37:42Z

Change https://go.dev/cl/455363 mentions this issue: [release-branch.go1.19] net/http: update bundled golang.org/x/net/http2

Disable cmd/internal/moddeps test, since this update includes PRIVATE track fixes. For #56350 For #57008 Fixes CVE-2022-41717 Change-Id: I31ebd2b9ae190ef6f7646187103ea1c8a713ff2e Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1663833 Reviewed-by: Tatiana Bradley <tatianabradley@google.com> Reviewed-by: Julie Qiu <julieqiu@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/455361 Run-TryBot: Jenny Rakoczy <jenny@golang.org> Reviewed-by: Michael Pratt <mpratt@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>

Disable cmd/internal/moddeps test, since this update includes PRIVATE track fixes. For #56350. For #57009. Fixes CVE-2022-41717. Change-Id: I5c6ce546add81f361dcf0d5123fa4eaaf8f0a03b Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1663835 Reviewed-by: Tatiana Bradley <tatianabradley@google.com> Reviewed-by: Julie Qiu <julieqiu@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/455363 TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Jenny Rakoczy <jenny@golang.org> Reviewed-by: Michael Pratt <mpratt@google.com>

damz · 2022-12-06T19:57:42Z

@neild @toothrot It seems like this has not made it yet to golang.org/x/net/http2.

gopherbot · 2022-12-06T19:59:37Z

Change https://go.dev/cl/455635 mentions this issue: http2: limit canonical header cache by bytes, not entries

toothrot · 2022-12-06T20:03:06Z

@damz correct, we always release Go first for private track issues.

The canonical header cache is a per-connection cache mapping header keys to their canonicalized form. (For example, "foo-bar" => "Foo-Bar"). We limit the number of entries in the cache to prevent an attacker from consuming unbounded amounts of memory by sending many unique keys, but a small number of very large keys can still consume an unreasonable amount of memory. Track the amount of memory consumed by the cache and limit it based on memory rather than number of entries. Thanks to Josselin Costanzi for reporting this issue. For golang/go#56350 Change-Id: I41db4c9823ed5bf371a9881accddff1268489b16 Reviewed-on: https://go-review.googlesource.com/c/net/+/455635 Reviewed-by: Jenny Rakoczy <jenny@golang.org> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>

thaJeztah · 2022-12-06T21:37:39Z

I see golang/net@1e63c2f was merged; will there be a tagged release with it?

toothrot · 2022-12-06T21:45:39Z

@thaJeztah Tagging will happen automatically after the post-submit build completes.

gopherbot · 2022-12-06T22:08:18Z

Change https://go.dev/cl/455717 mentions this issue: all: update vendored golang.org/x/net

gopherbot · 2022-12-06T22:20:54Z

Change https://go.dev/cl/455735 mentions this issue: [internal-branch.go1.18-vendor] http2: limit canonical header cache by bytes, not entries

gopherbot · 2022-12-06T22:20:55Z

Change https://go.dev/cl/455736 mentions this issue: [internal-branch.go1.19-vendor] http2: limit canonical header cache by bytes, not entries

Disable cmd/internal/moddeps test, since this update includes PRIVATE track fixes. For golang#56350. For golang#57009. Fixes CVE-2022-41717. Change-Id: I5c6ce546add81f361dcf0d5123fa4eaaf8f0a03b Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1663835 Reviewed-by: Tatiana Bradley <tatianabradley@google.com> Reviewed-by: Julie Qiu <julieqiu@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/455363 TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Jenny Rakoczy <jenny@golang.org> Reviewed-by: Michael Pratt <mpratt@google.com>

…y bytes, not entries The canonical header cache is a per-connection cache mapping header keys to their canonicalized form. (For example, "foo-bar" => "Foo-Bar"). We limit the number of entries in the cache to prevent an attacker from consuming unbounded amounts of memory by sending many unique keys, but a small number of very large keys can still consume an unreasonable amount of memory. Track the amount of memory consumed by the cache and limit it based on memory rather than number of entries. Thanks to Josselin Costanzi for reporting this issue. For golang/go#56350 For golang/go#57008 Fixes CVE-2022-41717 Change-Id: Ief3c141001524fd3776958ecc8556c724427f063 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1619953 Reviewed-by: Roland Shoemaker <bracewell@google.com> Reviewed-by: Julie Qiu <julieqiu@google.com> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1662692 Reviewed-by: Tatiana Bradley <tatianabradley@google.com> Reviewed-on: https://go-review.googlesource.com/c/net/+/455735 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Jenny Rakoczy <jenny@golang.org>

…y bytes, not entries The canonical header cache is a per-connection cache mapping header keys to their canonicalized form. (For example, "foo-bar" => "Foo-Bar"). We limit the number of entries in the cache to prevent an attacker from consuming unbounded amounts of memory by sending many unique keys, but a small number of very large keys can still consume an unreasonable amount of memory. Track the amount of memory consumed by the cache and limit it based on memory rather than number of entries. Thanks to Josselin Costanzi for reporting this issue. For golang/go#56350 For golang/go#57009 Fixes CVE-2022-41717 Change-Id: Ief3c141001524fd3776958ecc8556c724427f063 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1619953 Reviewed-by: Roland Shoemaker <bracewell@google.com> Reviewed-by: Julie Qiu <julieqiu@google.com> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1662693 Reviewed-by: Tatiana Bradley <tatianabradley@google.com> Reviewed-on: https://go-review.googlesource.com/c/net/+/455736 Reviewed-by: Jenny Rakoczy <jenny@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Dmitri Shuralyov <dmitshur@google.com>

The fix for golang/go#56350 has been included in k8s/client-go v0.25.5 via the version bump of the required golang.org/x/net dep to v0.3.1-0.20221206200815-1e63c2f08a10. This PR bumps the version of k8s/client-go to the latest avaialble v0.25.6 as of 01/23/23.

The fix for golang/go#56350 has been [included in the v0.4.0 release](golang/net@1e63c2f). This PR bumps the version of golang/x/net to v0.4.0 to pick up the CVE fix.

The fix for golang/go#56350 has been [included in the v0.4.0 release](golang/net@1e63c2f). This PR bumps the version of golang/x/net to v0.4.0 to pick up the CVE fix. (cherry picked from commit d946c585ef0877845bab7ec9ae027e2908392b4a) Signed-off-by: Todd Short <todd.short@me.com>

neild added Security release-blocker labels Oct 20, 2022

neild self-assigned this Oct 20, 2022

This was referenced Nov 30, 2022

security: fix CVE-2022-41717 [1.18 backport] #57008

Closed

security: fix CVE-2022-41717 [1.19 backport] #57009

Closed

dmitshur added this to the Go1.20 milestone Dec 6, 2022

toothrot changed the title ~~security: fix CVE-2022-41717~~ net/http: limit canonical header cache by bytes, not entries CVE-2022-41717 Dec 6, 2022

toothrot changed the title ~~net/http: limit canonical header cache by bytes, not entries CVE-2022-41717~~ net/http: limit canonical header cache by bytes, not entries (CVE-2022-41717) Dec 6, 2022

gopherbot closed this as completed in 8cd931f Dec 7, 2022

rcrozean mentioned this issue Dec 7, 2022

net/http: limit canonical header cache by bytes, not entries (CVE-2022-41717) aws/eks-distro-build-tooling#677

Closed

DonSealy mentioned this issue Dec 8, 2022

Fix security vulnerability CVE-2022-41717 exposed by Go gRPC dependency go-kit/kit#1253

Closed

This was referenced Dec 8, 2022

[OSS] security: update x/net module hashicorp/consul#15737

Merged

[OSS] chore: update x/net module for 1.13.x hashicorp/consul#15743

Merged

hc-github-team-consul-core mentioned this issue Dec 8, 2022

Backport of [OSS] security: update x/net module into release/1.14.x hashicorp/consul#15744

Merged

DanStough mentioned this issue Dec 8, 2022

[OSS] chore: update x/net module for release/1.12.x hashicorp/consul#15746

Merged

huberts90 mentioned this issue Dec 9, 2022

Fix CVE-2022-41717 (golang.org/x/net) gin-gonic/gin#3431

Closed

bcmills mentioned this issue Dec 9, 2022

x/net/http2: data race in TestCanonicalHeaderCacheGrowth #57218

Closed

andyasp mentioned this issue Dec 16, 2022

Update golang.org/x/net for CVE-2022-41717 grafana/mimir#3755

Merged

3 tasks

nmnellis mentioned this issue Dec 27, 2022

Update go library to fix CVE-2022-41717 istio/istio#42583

Closed

anik120 mentioned this issue Jan 23, 2023

fix: bump golang/x/net to v0.4.0 for CVE-2022-41717 operator-framework/rukpak#605

Merged

awgreene mentioned this issue Jan 24, 2023

OCPBUGS-6447: bump golang/x/net to v0.4.0 for CVE-2022-41717 openshift/operator-framework-rukpak#17

Merged

gnufied mentioned this issue Jan 27, 2023

Fix CVE-2022-41717 kubernetes-sigs/vsphere-csi-driver#2179

Merged

cx-tatianab mentioned this issue Feb 7, 2023

CVE-2022-41717 @ Go-golang.org/x/net-v0.0.0-20220225172249-27dd8689420f cx-tatianab/cxone-advanced-lab#67

Open

dorohayon mentioned this issue Feb 7, 2023

CVE-2022-41717 @ Go-golang.org/x/net-v0.0.0-20220225172249-27dd8689420f dorohayon/cxone-advanced-lab#79

Open

net/http: limit canonical header cache by bytes, not entries (CVE-2022-41717) #56350

net/http: limit canonical header cache by bytes, not entries (CVE-2022-41717) #56350

neild commented Oct 20, 2022 •

edited by dmitshur

neild commented Nov 30, 2022

gopherbot commented Nov 30, 2022

gopherbot commented Dec 6, 2022

gopherbot commented Dec 6, 2022

damz commented Dec 6, 2022

gopherbot commented Dec 6, 2022

toothrot commented Dec 6, 2022

thaJeztah commented Dec 6, 2022

toothrot commented Dec 6, 2022

gopherbot commented Dec 6, 2022

gopherbot commented Dec 6, 2022

gopherbot commented Dec 6, 2022

net/http: limit canonical header cache by bytes, not entries (CVE-2022-41717) #56350

net/http: limit canonical header cache by bytes, not entries (CVE-2022-41717) #56350

Comments

neild commented Oct 20, 2022 • edited by dmitshur

neild commented Nov 30, 2022

gopherbot commented Nov 30, 2022

gopherbot commented Dec 6, 2022

gopherbot commented Dec 6, 2022

damz commented Dec 6, 2022

gopherbot commented Dec 6, 2022

toothrot commented Dec 6, 2022

thaJeztah commented Dec 6, 2022

toothrot commented Dec 6, 2022

gopherbot commented Dec 6, 2022

gopherbot commented Dec 6, 2022

gopherbot commented Dec 6, 2022

neild commented Oct 20, 2022 •

edited by dmitshur