Browse code
Security Fix, CVE-2017-14992
Change-Id: I11267c7c4763c5cdfa40ff8de9b949acb916d84c
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/4561
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Anish Swaminathan <anishs@vmware.com>
Kumar Kaushik authored on 2017/12/22 07:47:23Showing 2 changed files
| 1 | 1 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,72 @@ |
| 0 |
+diff -ru docker-ce/components/engine/vendor/github.com/vbatts/tar-split/tar/asm/disassemble.go docker-ce-modified/components/engine/vendor/github.com/vbatts/tar-split/tar/asm/disassemble.go |
|
| 1 |
+--- docker-ce/components/engine/vendor/github.com/vbatts/tar-split/tar/asm/disassemble.go 2017-07-14 20:34:55.000000000 -0700 |
|
| 2 |
+@@ -2,7 +2,6 @@ |
|
| 3 |
+ |
|
| 4 |
+ import ( |
|
| 5 |
+ "io" |
|
| 6 |
+- "io/ioutil" |
|
| 7 |
+ |
|
| 8 |
+ "github.com/vbatts/tar-split/archive/tar" |
|
| 9 |
+ "github.com/vbatts/tar-split/tar/storage" |
|
| 10 |
+@@ -119,20 +118,34 @@ |
|
| 11 |
+ } |
|
| 12 |
+ } |
|
| 13 |
+ |
|
| 14 |
+- // it is allowable, and not uncommon that there is further padding on the |
|
| 15 |
+- // end of an archive, apart from the expected 1024 null bytes. |
|
| 16 |
+- remainder, err := ioutil.ReadAll(outputRdr) |
|
| 17 |
+- if err != nil && err != io.EOF {
|
|
| 18 |
+- pW.CloseWithError(err) |
|
| 19 |
+- return |
|
| 20 |
+- } |
|
| 21 |
+- _, err = p.AddEntry(storage.Entry{
|
|
| 22 |
+- Type: storage.SegmentType, |
|
| 23 |
+- Payload: remainder, |
|
| 24 |
+- }) |
|
| 25 |
+- if err != nil {
|
|
| 26 |
+- pW.CloseWithError(err) |
|
| 27 |
+- return |
|
| 28 |
++ // It is allowable, and not uncommon that there is further padding on |
|
| 29 |
++ // the end of an archive, apart from the expected 1024 null bytes. We |
|
| 30 |
++ // do this in chunks rather than in one go to avoid cases where a |
|
| 31 |
++ // maliciously crafted tar file tries to trick us into reading many GBs |
|
| 32 |
++ // into memory. |
|
| 33 |
++ const paddingChunkSize = 1024 * 1024 |
|
| 34 |
++ var paddingChunk [paddingChunkSize]byte |
|
| 35 |
++ for {
|
|
| 36 |
++ var isEOF bool |
|
| 37 |
++ n, err := outputRdr.Read(paddingChunk[:]) |
|
| 38 |
++ if err != nil {
|
|
| 39 |
++ if err != io.EOF {
|
|
| 40 |
++ pW.CloseWithError(err) |
|
| 41 |
++ return |
|
| 42 |
++ } |
|
| 43 |
++ isEOF = true |
|
| 44 |
++ } |
|
| 45 |
++ _, err = p.AddEntry(storage.Entry{
|
|
| 46 |
++ Type: storage.SegmentType, |
|
| 47 |
++ Payload: paddingChunk[:n], |
|
| 48 |
++ }) |
|
| 49 |
++ if err != nil {
|
|
| 50 |
++ pW.CloseWithError(err) |
|
| 51 |
++ return |
|
| 52 |
++ } |
|
| 53 |
++ if isEOF {
|
|
| 54 |
++ break |
|
| 55 |
++ } |
|
| 56 |
+ } |
|
| 57 |
+ pW.Close() |
|
| 58 |
+ }() |
|
| 59 |
+diff -ru docker-ce/components/engine/vendor.conf docker-ce-modified/components/engine/vendor.conf |
|
| 60 |
+--- docker-ce/components/engine/vendor.conf 2017-07-14 20:34:55.000000000 -0700 |
|
| 61 |
+@@ -50,7 +50,7 @@ |
|
| 62 |
+ |
|
| 63 |
+ # get graph and distribution packages |
|
| 64 |
+ github.com/docker/distribution b38e5838b7b2f2ad48e06ec4b500011976080621 |
|
| 65 |
+-github.com/vbatts/tar-split v0.10.1 |
|
| 66 |
++github.com/vbatts/tar-split v0.10.2 |
|
| 67 |
+ github.com/opencontainers/go-digest a6d0ee40d4207ea02364bd3b9e8e77b9159ba1eb |
|
| 68 |
+ |
|
| 69 |
+ # get go-zfs packages |
| ... | ... |
@@ -3,7 +3,7 @@ |
| 3 | 3 |
Summary: Docker |
| 4 | 4 |
Name: docker |
| 5 | 5 |
Version: 17.06.0 |
| 6 |
-Release: 1%{?dist}
|
|
| 6 |
+Release: 2%{?dist}
|
|
| 7 | 7 |
License: ASL 2.0 |
| 8 | 8 |
URL: http://docs.docker.com |
| 9 | 9 |
Group: Applications/File |
| ... | ... |
@@ -25,6 +25,7 @@ Source4: https://github.com/krallin/tini/tree/tini-949e6fa.tar.gz |
| 25 | 25 |
Source5: https://github.com/cpuguy83/go-md2man/tree/go-md2man-a65d4d2.tar.gz |
| 26 | 26 |
%define sha1 go-md2man=e3d0865c583150f7c76e385a8b4a3f2432ca8ad8 |
| 27 | 27 |
Patch0: remove-firewalld.patch |
| 28 |
+Patch1: CVE-2017-14992.patch |
|
| 28 | 29 |
|
| 29 | 30 |
BuildRequires: systemd |
| 30 | 31 |
BuildRequires: device-mapper-devel |
| ... | ... |
@@ -70,6 +71,7 @@ ln -s docker-ce/components/engine engine |
| 70 | 70 |
ln -s docker-ce/components/packaging packaging |
| 71 | 71 |
|
| 72 | 72 |
%patch0 -p2 |
| 73 |
+%patch1 -p2 |
|
| 73 | 74 |
|
| 74 | 75 |
mkdir -p /go/src/github.com |
| 75 | 76 |
cd /go/src/github.com |
| ... | ... |
@@ -213,6 +215,8 @@ rm -rf %{buildroot}/*
|
| 213 | 213 |
%{_datadir}/vim/vimfiles/syntax/dockerfile.vim
|
| 214 | 214 |
|
| 215 | 215 |
%changelog |
| 216 |
+* Thu Dec 21 2017 Kumar Kaushik <kaushikk@vmware.com> 17.06.0-2 |
|
| 217 |
+- Applying patch for CVE-2017-14992 |
|
| 216 | 218 |
* Tue Jul 18 2017 Bo Gan <ganb@vmware.com> 17.06.0-1 |
| 217 | 219 |
- Update to 17.06.0-ce |
| 218 | 220 |
* Mon Jul 10 2017 Bo Gan <ganb@vmware.com> 1.13.1-4 |