1. photon
  2. Commit 550b50fcf87049d1d1b706d95047003aced91fc6
Browse code

nginx: fix CVE-2018-16843, CVE-2018-16844

Added upstream patch to fix the CVEs

Change-Id: Ie3998cd6ee686f496ff691c7fba1f923239706d5
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/6761
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Anish Swaminathan <anishs@vmware.com>

Ankit Jain authored on 2019/02/20 05:17:05
Showing 3 changed files
SPECS/nginx/nginx-CVE-2018-16843.patch
History View file @ 550b50f
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,59 @@
0 
+# HG changeset patch
1 
+# User Ruslan Ermilov <ru@nginx.com>
2 
+# Date 1541510975 -10800
3 
+# Node ID 1c6b6163c03945bcc65c252cc42b0af18744c085
4 
+# Parent  fdc19a3289c1138bfe49ddbde310778ddc495729
5 
+HTTP/2: flood detection.
6 
+
7 
+Fixed uncontrolled memory growth in case peer is flooding us with
8 
+some frames (e.g., SETTINGS and PING) and doesn't read data.  Fix
9 
+is to limit the number of allocated control frames.
10 
+
11 
+diff -r fdc19a3289c1 -r 1c6b6163c039 src/http/v2/ngx_http_v2.c
12 
+--- a/src/http/v2/ngx_http_v2.c	Tue Nov 06 16:29:18 2018 +0300
13 
+@@ -664,6 +664,7 @@
14 
+
15 
+     h2c->pool = NULL;
16 
+     h2c->free_frames = NULL;
17 
++    h2c->frames = 0;
18 
+     h2c->free_fake_connections = NULL;
19 
+
20 
+ #if (NGX_HTTP_SSL)
21 
+@@ -2895,7 +2896,7 @@
22 
+
23 
+         frame->blocked = 0;
24 
+
25 
+-    } else {
26 
++    } else if (h2c->frames < 10000) {
27 
+         pool = h2c->pool ? h2c->pool : h2c->connection->pool;
28 
+
29 
+         frame = ngx_pcalloc(pool, sizeof(ngx_http_v2_out_frame_t));
30 
+@@ -2919,6 +2920,15 @@
31 
+         frame->last = frame->first;
32 
+
33 
+         frame->handler = ngx_http_v2_frame_handler;
34 
++
35 
++        h2c->frames++;
36 
++
37 
++    } else {
38 
++        ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
39 
++                      "http2 flood detected");
40 
++
41 
++        h2c->connection->error = 1;
42 
++        return NULL;
43 
+     }
44 
+
45 
+ #if (NGX_DEBUG)
46 
+diff -r fdc19a3289c1 -r 1c6b6163c039 src/http/v2/ngx_http_v2.h
47 
+--- a/src/http/v2/ngx_http_v2.h	Tue Nov 06 16:29:18 2018 +0300
48 
+@@ -120,6 +120,7 @@
49 
+     ngx_http_connection_t           *http_connection;
50 
+
51 
+     ngx_uint_t                       processing;
52 
++    ngx_uint_t                       frames;
53 
+
54 
+     ngx_uint_t                       pushing;
55 
+     ngx_uint_t                       concurrent_pushes;
56 
+
SPECS/nginx/nginx-CVE-2018-16844.patch
History View file @ 550b50f
0 57 
new file mode 100644
... ... 
@@ -0,0 +1,57 @@
0 
+# HG changeset patch
1 
+# User Ruslan Ermilov <ru@nginx.com>
2 
+# Date 1541510989 -10800
3 
+# Node ID 9200b41db765fbd6709765ba2d218e78ad8e9860
4 
+# Parent  1c6b6163c03945bcc65c252cc42b0af18744c085
5 
+HTTP/2: limit the number of idle state switches.
6 
+
7 
+An attack that continuously switches HTTP/2 connection between
8 
+idle and active states can result in excessive CPU usage.
9 
+This is because when a connection switches to the idle state,
10 
+all of its memory pool caches are freed.
11 
+
12 
+This change limits the maximum allowed number of idle state
13 
+switches to 10 * http2_max_requests (i.e., 10000 by default).
14 
+This limits possible CPU usage in one connection, and also
15 
+imposes a limit on the maximum lifetime of a connection.
16 
+
17 
+Initially reported by Gal Goldshtein from F5 Networks.
18 
+
19 
+diff -r 1c6b6163c039 -r 9200b41db765 src/http/v2/ngx_http_v2.c
20 
+--- a/src/http/v2/ngx_http_v2.c	Tue Nov 06 16:29:35 2018 +0300
21 
+@@ -4481,12 +4481,19 @@
22 
+
23 
+ #endif
24 
+
25 
++    h2scf = ngx_http_get_module_srv_conf(h2c->http_connection->conf_ctx,
26 
++                                         ngx_http_v2_module);
27 
++
28 
++    if (h2c->idle++ > 10 * h2scf->max_requests) {
29 
++        ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
30 
++                      "http2 flood detected");
31 
++        ngx_http_v2_finalize_connection(h2c, NGX_HTTP_V2_NO_ERROR);
32 
++        return;
33 
++    }
34 
++
35 
+     c->destroyed = 0;
36 
+     ngx_reusable_connection(c, 0);
37 
+
38 
+-    h2scf = ngx_http_get_module_srv_conf(h2c->http_connection->conf_ctx,
39 
+-                                         ngx_http_v2_module);
40 
+-
41 
+     h2c->pool = ngx_create_pool(h2scf->pool_size, h2c->connection->log);
42 
+     if (h2c->pool == NULL) {
43 
+         ngx_http_v2_finalize_connection(h2c, NGX_HTTP_V2_INTERNAL_ERROR);
44 
+diff -r 1c6b6163c039 -r 9200b41db765 src/http/v2/ngx_http_v2.h
45 
+--- a/src/http/v2/ngx_http_v2.h	Tue Nov 06 16:29:35 2018 +0300
46 
+@@ -121,6 +121,7 @@
47 
+
48 
+     ngx_uint_t                       processing;
49 
+     ngx_uint_t                       frames;
50 
++    ngx_uint_t                       idle;
51 
+
52 
+     ngx_uint_t                       pushing;
53 
+     ngx_uint_t                       concurrent_pushes;
54 
+
SPECS/nginx/nginx.spec
History View file @ 550b50f
... ... 
@@ -1,7 +1,7 @@
1 1 
 Summary:        High-performance HTTP server and reverse proxy
2 2 
 Name:           nginx
3 3 
 Version:        1.15.3
4 
-Release:        4%{?dist}
4 
+Release:        5%{?dist}
5 5 
 License:        BSD-2-Clause
6 6 
 URL:            http://nginx.org/download/nginx-%{version}.tar.gz
7 7 
 Group:          Applications/System
... ... 
@@ -13,6 +13,8 @@ Source1:        nginx.service
13 13 
 Source2:        nginx-njs-0.2.1.tar.gz
14 14 
 %define sha1    nginx-njs=fd8c3f2d219f175be958796e3beaa17f3b465126
15 15 
 Patch0:		nginx-CVE-2018-16845.patch
16 
+patch1:         nginx-CVE-2018-16843.patch
17 
+patch2:         nginx-CVE-2018-16844.patch
16 18 
 BuildRequires:  openssl-devel
17 19 
 BuildRequires:  pcre-devel
18 20 
 BuildRequires:  which
... ... 
@@ -22,6 +24,8 @@ NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as
22 22 
 %prep
23 23 
 %setup -q
24 24 
 %patch0 -p1
25 
+%patch1 -p1
26 
+%patch2 -p1
25 27 
 pushd ../
26 28 
 mkdir nginx-njs
27 29 
 tar -C nginx-njs -xf %{SOURCE2}
... ... 
@@ -77,6 +81,8 @@ install -p -m 0644 %{SOURCE1} %{buildroot}/usr/lib/systemd/system/nginx.service
77 77 
 %{_var}/log/nginx
78 78
79 79 
 %changelog
80 
+*   Mon Feb 25 2019 Ankit Jain <ankitja@vmware.com> 1.15.3-5
81 
+-   Fix for CVE-2018-16843 and CVE-2018-16844
80 82 
 *   Thu Feb 21 2019 Siju Maliakkal <smaliakkal@vmware.com> 1.15.3-4
81 83 
 -   Fix CVE-2018-16845
82 84 
 *   Wed Nov 07 2018 Ajay Kaher <akaher@vmware.com> 1.15.3-3