* [meta-virtualization][kirkstone][PATCH] kubernetes: Security fix for CVE-2023-3676 and CVE-2023-3955
@ 2024-09-05 12:41 vanusuri
2024-09-05 19:40 ` Bruce Ashfield
0 siblings, 1 reply; 2+ messages in thread
From: vanusuri @ 2024-09-05 12:41 UTC (permalink / raw)
To: meta-virtualization; +Cc: Vijay Anusuri
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-commit:
https://github.com/kubernetes/kubernetes/commit/7da6d72c05dffb3b87e62e2bc8c3228ea12ba1b9
& https://github.com/kubernetes/kubernetes/commit/a53faf5e17ed0b0771a605c6401ba4cbf297b59a
Reference:
https://github.com/kubernetes/kubernetes/issues/119339
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
.../kubernetes/kubernetes/CVE-2023-3676.patch | 46 +++++++++++
.../kubernetes/kubernetes/CVE-2023-3955.patch | 79 +++++++++++++++++++
.../kubernetes/kubernetes_git.bb | 2 +
3 files changed, 127 insertions(+)
create mode 100644 recipes-containers/kubernetes/kubernetes/CVE-2023-3676.patch
create mode 100644 recipes-containers/kubernetes/kubernetes/CVE-2023-3955.patch
diff --git a/recipes-containers/kubernetes/kubernetes/CVE-2023-3676.patch b/recipes-containers/kubernetes/kubernetes/CVE-2023-3676.patch
new file mode 100644
index 00000000..835a43b4
--- /dev/null
+++ b/recipes-containers/kubernetes/kubernetes/CVE-2023-3676.patch
@@ -0,0 +1,46 @@
+From c80d622eed1c499139c51bd47c8dc756682fbe66 Mon Sep 17 00:00:00 2001
+From: James Sturtevant <jstur@microsoft.com>
+Date: Thu, 20 Jul 2023 17:00:29 +0000
+Subject: [PATCH] Use env varaibles for passing path
+
+The subpath could be passed a powershell subexpression which would be executed by kubelet with privilege. Switching to pass the arguments via environment variables means the subexpression won't be evaluated.
+
+Signed-off-by: James Sturtevant <jstur@microsoft.com>
+
+Upstream-Status: Backport [https://github.com/kubernetes/kubernetes/commit/a53faf5e17ed0b0771a605c6401ba4cbf297b59a]
+CVE: CVE-2023-3676
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ pkg/volume/util/subpath/subpath_windows.go | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/pkg/volume/util/subpath/subpath_windows.go b/pkg/volume/util/subpath/subpath_windows.go
+index e7f77d07f7557..c9b67aa8c78ff 100644
+--- a/pkg/volume/util/subpath/subpath_windows.go
++++ b/pkg/volume/util/subpath/subpath_windows.go
+@@ -76,8 +76,10 @@ func getUpperPath(path string) string {
+ // Check whether a directory/file is a link type or not
+ // LinkType could be SymbolicLink, Junction, or HardLink
+ func isLinkPath(path string) (bool, error) {
+- cmd := fmt.Sprintf("(Get-Item -LiteralPath %q).LinkType", path)
+- output, err := exec.Command("powershell", "/c", cmd).CombinedOutput()
++ cmd := exec.Command("powershell", "/c", "$ErrorActionPreference = 'Stop'; (Get-Item -Force -LiteralPath $env:linkpath).LinkType")
++ cmd.Env = append(os.Environ(), fmt.Sprintf("linkpath=%s", path))
++ klog.V(8).Infof("Executing command: %q", cmd.String())
++ output, err := cmd.CombinedOutput()
+ if err != nil {
+ return false, err
+ }
+@@ -114,8 +116,10 @@ func evalSymlink(path string) (string, error) {
+ }
+ }
+ // This command will give the target path of a given symlink
+- cmd := fmt.Sprintf("(Get-Item -LiteralPath %q).Target", upperpath)
+- output, err := exec.Command("powershell", "/c", cmd).CombinedOutput()
++ cmd := exec.Command("powershell", "/c", "$ErrorActionPreference = 'Stop'; (Get-Item -Force -LiteralPath $env:linkpath).Target")
++ cmd.Env = append(os.Environ(), fmt.Sprintf("linkpath=%s", upperpath))
++ klog.V(8).Infof("Executing command: %q", cmd.String())
++ output, err := cmd.CombinedOutput()
+ if err != nil {
+ return "", err
+ }
diff --git a/recipes-containers/kubernetes/kubernetes/CVE-2023-3955.patch b/recipes-containers/kubernetes/kubernetes/CVE-2023-3955.patch
new file mode 100644
index 00000000..6f2518cf
--- /dev/null
+++ b/recipes-containers/kubernetes/kubernetes/CVE-2023-3955.patch
@@ -0,0 +1,79 @@
+From 5f89e4c983f0a55e6cc21ca05436496a208d8eb7 Mon Sep 17 00:00:00 2001
+From: James Sturtevant <jstur@microsoft.com>
+Date: Mon, 17 Jul 2023 14:24:02 -0700
+Subject: [PATCH] Use environment varaibles for parameters in Powershell
+
+As a defense in depth, pass parameters to powershell via environment variables.
+
+Signed-off-by: James Sturtevant <jstur@microsoft.com>
+
+Upstream-Status: Backport [https://github.com/kubernetes/kubernetes/commit/7da6d72c05dffb3b87e62e2bc8c3228ea12ba1b9]
+CVE: CVE-2023-3955
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ pkg/volume/util/util.go | 12 +++++++----
+ .../src/k8s.io/mount-utils/mount_windows.go | 20 +++++++++++++------
+ 2 files changed, 22 insertions(+), 10 deletions(-)
+
+diff --git a/pkg/volume/util/util.go b/pkg/volume/util/util.go
+index dffdfd6d899c1..cd70a52d277db 100644
+--- a/pkg/volume/util/util.go
++++ b/pkg/volume/util/util.go
+@@ -656,11 +656,15 @@ func HasMountRefs(mountPath string, mountRefs []string) bool {
+ func WriteVolumeCache(deviceMountPath string, exec utilexec.Interface) error {
+ // If runtime os is windows, execute Write-VolumeCache powershell command on the disk
+ if runtime.GOOS == "windows" {
+- cmd := fmt.Sprintf("Get-Volume -FilePath %s | Write-Volumecache", deviceMountPath)
+- output, err := exec.Command("powershell", "/c", cmd).CombinedOutput()
+- klog.Infof("command (%q) execeuted: %v, output: %q", cmd, err, string(output))
++ cmdString := "Get-Volume -FilePath $env:mountpath | Write-Volumecache"
++ cmd := exec.Command("powershell", "/c", cmdString)
++ env := append(os.Environ(), fmt.Sprintf("mountpath=%s", deviceMountPath))
++ cmd.SetEnv(env)
++ klog.Infof("Executing command: %q", cmdString)
++ output, err := cmd.CombinedOutput()
++ klog.Infof("command (%q) execeuted: %v, output: %q", cmdString, err, string(output))
+ if err != nil {
+- return fmt.Errorf("command (%q) failed: %v, output: %q", cmd, err, string(output))
++ return fmt.Errorf("command (%q) failed: %v, output: %q", cmdString, err, string(output))
+ }
+ }
+ // For linux runtime, it skips because unmount will automatically flush disk data
+diff --git a/staging/src/k8s.io/mount-utils/mount_windows.go b/staging/src/k8s.io/mount-utils/mount_windows.go
+index c7fcde5fc98f4..d96bf2237899f 100644
+--- a/staging/src/k8s.io/mount-utils/mount_windows.go
++++ b/staging/src/k8s.io/mount-utils/mount_windows.go
+@@ -278,10 +278,16 @@ func (mounter *SafeFormatAndMount) formatAndMountSensitive(source string, target
+ fstype = "NTFS"
+ }
+
+- // format disk if it is unformatted(raw)
+- cmd := fmt.Sprintf("Get-Disk -Number %s | Where partitionstyle -eq 'raw' | Initialize-Disk -PartitionStyle GPT -PassThru"+
+- " | New-Partition -UseMaximumSize | Format-Volume -FileSystem %s -Confirm:$false", source, fstype)
+- if output, err := mounter.Exec.Command("powershell", "/c", cmd).CombinedOutput(); err != nil {
++ cmdString := "Get-Disk -Number $env:source | Where partitionstyle -eq 'raw' | Initialize-Disk -PartitionStyle GPT -PassThru" +
++ " | New-Partition -UseMaximumSize | Format-Volume -FileSystem $env:fstype -Confirm:$false"
++ cmd := mounter.Exec.Command("powershell", "/c", cmdString)
++ env := append(os.Environ(),
++ fmt.Sprintf("source=%s", source),
++ fmt.Sprintf("fstype=%s", fstype),
++ )
++ cmd.SetEnv(env)
++ klog.V(8).Infof("Executing command: %q", cmdString)
++ if output, err := cmd.CombinedOutput(); err != nil {
+ return fmt.Errorf("diskMount: format disk failed, error: %v, output: %q", err, string(output))
+ }
+ klog.V(4).Infof("diskMount: Disk successfully formatted, disk: %q, fstype: %q", source, fstype)
+@@ -303,8 +309,10 @@ func (mounter *SafeFormatAndMount) formatAndMountSensitive(source string, target
+
+ // ListVolumesOnDisk - returns back list of volumes(volumeIDs) in the disk (requested in diskID).
+ func listVolumesOnDisk(diskID string) (volumeIDs []string, err error) {
+- cmd := fmt.Sprintf("(Get-Disk -DeviceId %s | Get-Partition | Get-Volume).UniqueId", diskID)
+- output, err := exec.Command("powershell", "/c", cmd).CombinedOutput()
++ cmd := exec.Command("powershell", "/c", "(Get-Disk -DeviceId $env:diskID | Get-Partition | Get-Volume).UniqueId")
++ cmd.Env = append(os.Environ(), fmt.Sprintf("diskID=%s", diskID))
++ klog.V(8).Infof("Executing command: %q", cmd.String())
++ output, err := cmd.CombinedOutput()
+ klog.V(4).Infof("listVolumesOnDisk id from %s: %s", diskID, string(output))
+ if err != nil {
+ return []string{}, fmt.Errorf("error list volumes on disk. cmd: %s, output: %s, error: %v", cmd, string(output), err)
diff --git a/recipes-containers/kubernetes/kubernetes_git.bb b/recipes-containers/kubernetes/kubernetes_git.bb
index f374892a..9d6179e0 100644
--- a/recipes-containers/kubernetes/kubernetes_git.bb
+++ b/recipes-containers/kubernetes/kubernetes_git.bb
@@ -36,6 +36,8 @@ SRC_URI:append = " \
file://k8s-init \
file://99-kubernetes.conf \
file://CVE-2024-3177.patch;patchdir=src/import \
+ file://CVE-2023-3955.patch;patchdir=src/import \
+ file://CVE-2023-3676.patch;patchdir=src/import \
"
DEPENDS += "rsync-native \
--
2.25.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [meta-virtualization][kirkstone][PATCH] kubernetes: Security fix for CVE-2023-3676 and CVE-2023-3955
2024-09-05 12:41 [meta-virtualization][kirkstone][PATCH] kubernetes: Security fix for CVE-2023-3676 and CVE-2023-3955 vanusuri
@ 2024-09-05 19:40 ` Bruce Ashfield
0 siblings, 0 replies; 2+ messages in thread
From: Bruce Ashfield @ 2024-09-05 19:40 UTC (permalink / raw)
To: vanusuri; +Cc: meta-virtualization
merged.
Bruce
In message: [meta-virtualization][kirkstone][PATCH] kubernetes: Security fix for CVE-2023-3676 and CVE-2023-3955
on 05/09/2024 Vijay Anusuri via lists.yoctoproject.org wrote:
> From: Vijay Anusuri <vanusuri@mvista.com>
>
> Upstream-commit:
> https://github.com/kubernetes/kubernetes/commit/7da6d72c05dffb3b87e62e2bc8c3228ea12ba1b9
> & https://github.com/kubernetes/kubernetes/commit/a53faf5e17ed0b0771a605c6401ba4cbf297b59a
>
> Reference:
> https://github.com/kubernetes/kubernetes/issues/119339
>
> Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> ---
> .../kubernetes/kubernetes/CVE-2023-3676.patch | 46 +++++++++++
> .../kubernetes/kubernetes/CVE-2023-3955.patch | 79 +++++++++++++++++++
> .../kubernetes/kubernetes_git.bb | 2 +
> 3 files changed, 127 insertions(+)
> create mode 100644 recipes-containers/kubernetes/kubernetes/CVE-2023-3676.patch
> create mode 100644 recipes-containers/kubernetes/kubernetes/CVE-2023-3955.patch
>
> diff --git a/recipes-containers/kubernetes/kubernetes/CVE-2023-3676.patch b/recipes-containers/kubernetes/kubernetes/CVE-2023-3676.patch
> new file mode 100644
> index 00000000..835a43b4
> --- /dev/null
> +++ b/recipes-containers/kubernetes/kubernetes/CVE-2023-3676.patch
> @@ -0,0 +1,46 @@
> +From c80d622eed1c499139c51bd47c8dc756682fbe66 Mon Sep 17 00:00:00 2001
> +From: James Sturtevant <jstur@microsoft.com>
> +Date: Thu, 20 Jul 2023 17:00:29 +0000
> +Subject: [PATCH] Use env varaibles for passing path
> +
> +The subpath could be passed a powershell subexpression which would be executed by kubelet with privilege. Switching to pass the arguments via environment variables means the subexpression won't be evaluated.
> +
> +Signed-off-by: James Sturtevant <jstur@microsoft.com>
> +
> +Upstream-Status: Backport [https://github.com/kubernetes/kubernetes/commit/a53faf5e17ed0b0771a605c6401ba4cbf297b59a]
> +CVE: CVE-2023-3676
> +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> +---
> + pkg/volume/util/subpath/subpath_windows.go | 12 ++++++++----
> + 1 file changed, 8 insertions(+), 4 deletions(-)
> +
> +diff --git a/pkg/volume/util/subpath/subpath_windows.go b/pkg/volume/util/subpath/subpath_windows.go
> +index e7f77d07f7557..c9b67aa8c78ff 100644
> +--- a/pkg/volume/util/subpath/subpath_windows.go
> ++++ b/pkg/volume/util/subpath/subpath_windows.go
> +@@ -76,8 +76,10 @@ func getUpperPath(path string) string {
> + // Check whether a directory/file is a link type or not
> + // LinkType could be SymbolicLink, Junction, or HardLink
> + func isLinkPath(path string) (bool, error) {
> +- cmd := fmt.Sprintf("(Get-Item -LiteralPath %q).LinkType", path)
> +- output, err := exec.Command("powershell", "/c", cmd).CombinedOutput()
> ++ cmd := exec.Command("powershell", "/c", "$ErrorActionPreference = 'Stop'; (Get-Item -Force -LiteralPath $env:linkpath).LinkType")
> ++ cmd.Env = append(os.Environ(), fmt.Sprintf("linkpath=%s", path))
> ++ klog.V(8).Infof("Executing command: %q", cmd.String())
> ++ output, err := cmd.CombinedOutput()
> + if err != nil {
> + return false, err
> + }
> +@@ -114,8 +116,10 @@ func evalSymlink(path string) (string, error) {
> + }
> + }
> + // This command will give the target path of a given symlink
> +- cmd := fmt.Sprintf("(Get-Item -LiteralPath %q).Target", upperpath)
> +- output, err := exec.Command("powershell", "/c", cmd).CombinedOutput()
> ++ cmd := exec.Command("powershell", "/c", "$ErrorActionPreference = 'Stop'; (Get-Item -Force -LiteralPath $env:linkpath).Target")
> ++ cmd.Env = append(os.Environ(), fmt.Sprintf("linkpath=%s", upperpath))
> ++ klog.V(8).Infof("Executing command: %q", cmd.String())
> ++ output, err := cmd.CombinedOutput()
> + if err != nil {
> + return "", err
> + }
> diff --git a/recipes-containers/kubernetes/kubernetes/CVE-2023-3955.patch b/recipes-containers/kubernetes/kubernetes/CVE-2023-3955.patch
> new file mode 100644
> index 00000000..6f2518cf
> --- /dev/null
> +++ b/recipes-containers/kubernetes/kubernetes/CVE-2023-3955.patch
> @@ -0,0 +1,79 @@
> +From 5f89e4c983f0a55e6cc21ca05436496a208d8eb7 Mon Sep 17 00:00:00 2001
> +From: James Sturtevant <jstur@microsoft.com>
> +Date: Mon, 17 Jul 2023 14:24:02 -0700
> +Subject: [PATCH] Use environment varaibles for parameters in Powershell
> +
> +As a defense in depth, pass parameters to powershell via environment variables.
> +
> +Signed-off-by: James Sturtevant <jstur@microsoft.com>
> +
> +Upstream-Status: Backport [https://github.com/kubernetes/kubernetes/commit/7da6d72c05dffb3b87e62e2bc8c3228ea12ba1b9]
> +CVE: CVE-2023-3955
> +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> +---
> + pkg/volume/util/util.go | 12 +++++++----
> + .../src/k8s.io/mount-utils/mount_windows.go | 20 +++++++++++++------
> + 2 files changed, 22 insertions(+), 10 deletions(-)
> +
> +diff --git a/pkg/volume/util/util.go b/pkg/volume/util/util.go
> +index dffdfd6d899c1..cd70a52d277db 100644
> +--- a/pkg/volume/util/util.go
> ++++ b/pkg/volume/util/util.go
> +@@ -656,11 +656,15 @@ func HasMountRefs(mountPath string, mountRefs []string) bool {
> + func WriteVolumeCache(deviceMountPath string, exec utilexec.Interface) error {
> + // If runtime os is windows, execute Write-VolumeCache powershell command on the disk
> + if runtime.GOOS == "windows" {
> +- cmd := fmt.Sprintf("Get-Volume -FilePath %s | Write-Volumecache", deviceMountPath)
> +- output, err := exec.Command("powershell", "/c", cmd).CombinedOutput()
> +- klog.Infof("command (%q) execeuted: %v, output: %q", cmd, err, string(output))
> ++ cmdString := "Get-Volume -FilePath $env:mountpath | Write-Volumecache"
> ++ cmd := exec.Command("powershell", "/c", cmdString)
> ++ env := append(os.Environ(), fmt.Sprintf("mountpath=%s", deviceMountPath))
> ++ cmd.SetEnv(env)
> ++ klog.Infof("Executing command: %q", cmdString)
> ++ output, err := cmd.CombinedOutput()
> ++ klog.Infof("command (%q) execeuted: %v, output: %q", cmdString, err, string(output))
> + if err != nil {
> +- return fmt.Errorf("command (%q) failed: %v, output: %q", cmd, err, string(output))
> ++ return fmt.Errorf("command (%q) failed: %v, output: %q", cmdString, err, string(output))
> + }
> + }
> + // For linux runtime, it skips because unmount will automatically flush disk data
> +diff --git a/staging/src/k8s.io/mount-utils/mount_windows.go b/staging/src/k8s.io/mount-utils/mount_windows.go
> +index c7fcde5fc98f4..d96bf2237899f 100644
> +--- a/staging/src/k8s.io/mount-utils/mount_windows.go
> ++++ b/staging/src/k8s.io/mount-utils/mount_windows.go
> +@@ -278,10 +278,16 @@ func (mounter *SafeFormatAndMount) formatAndMountSensitive(source string, target
> + fstype = "NTFS"
> + }
> +
> +- // format disk if it is unformatted(raw)
> +- cmd := fmt.Sprintf("Get-Disk -Number %s | Where partitionstyle -eq 'raw' | Initialize-Disk -PartitionStyle GPT -PassThru"+
> +- " | New-Partition -UseMaximumSize | Format-Volume -FileSystem %s -Confirm:$false", source, fstype)
> +- if output, err := mounter.Exec.Command("powershell", "/c", cmd).CombinedOutput(); err != nil {
> ++ cmdString := "Get-Disk -Number $env:source | Where partitionstyle -eq 'raw' | Initialize-Disk -PartitionStyle GPT -PassThru" +
> ++ " | New-Partition -UseMaximumSize | Format-Volume -FileSystem $env:fstype -Confirm:$false"
> ++ cmd := mounter.Exec.Command("powershell", "/c", cmdString)
> ++ env := append(os.Environ(),
> ++ fmt.Sprintf("source=%s", source),
> ++ fmt.Sprintf("fstype=%s", fstype),
> ++ )
> ++ cmd.SetEnv(env)
> ++ klog.V(8).Infof("Executing command: %q", cmdString)
> ++ if output, err := cmd.CombinedOutput(); err != nil {
> + return fmt.Errorf("diskMount: format disk failed, error: %v, output: %q", err, string(output))
> + }
> + klog.V(4).Infof("diskMount: Disk successfully formatted, disk: %q, fstype: %q", source, fstype)
> +@@ -303,8 +309,10 @@ func (mounter *SafeFormatAndMount) formatAndMountSensitive(source string, target
> +
> + // ListVolumesOnDisk - returns back list of volumes(volumeIDs) in the disk (requested in diskID).
> + func listVolumesOnDisk(diskID string) (volumeIDs []string, err error) {
> +- cmd := fmt.Sprintf("(Get-Disk -DeviceId %s | Get-Partition | Get-Volume).UniqueId", diskID)
> +- output, err := exec.Command("powershell", "/c", cmd).CombinedOutput()
> ++ cmd := exec.Command("powershell", "/c", "(Get-Disk -DeviceId $env:diskID | Get-Partition | Get-Volume).UniqueId")
> ++ cmd.Env = append(os.Environ(), fmt.Sprintf("diskID=%s", diskID))
> ++ klog.V(8).Infof("Executing command: %q", cmd.String())
> ++ output, err := cmd.CombinedOutput()
> + klog.V(4).Infof("listVolumesOnDisk id from %s: %s", diskID, string(output))
> + if err != nil {
> + return []string{}, fmt.Errorf("error list volumes on disk. cmd: %s, output: %s, error: %v", cmd, string(output), err)
> diff --git a/recipes-containers/kubernetes/kubernetes_git.bb b/recipes-containers/kubernetes/kubernetes_git.bb
> index f374892a..9d6179e0 100644
> --- a/recipes-containers/kubernetes/kubernetes_git.bb
> +++ b/recipes-containers/kubernetes/kubernetes_git.bb
> @@ -36,6 +36,8 @@ SRC_URI:append = " \
> file://k8s-init \
> file://99-kubernetes.conf \
> file://CVE-2024-3177.patch;patchdir=src/import \
> + file://CVE-2023-3955.patch;patchdir=src/import \
> + file://CVE-2023-3676.patch;patchdir=src/import \
> "
>
> DEPENDS += "rsync-native \
> --
> 2.25.1
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#8867): https://lists.yoctoproject.org/g/meta-virtualization/message/8867
> Mute This Topic: https://lists.yoctoproject.org/mt/108284035/1050810
> Group Owner: meta-virtualization+owner@lists.yoctoproject.org
> Unsubscribe: https://lists.yoctoproject.org/g/meta-virtualization/unsub [bruce.ashfield@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-09-05 19:40 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-09-05 12:41 [meta-virtualization][kirkstone][PATCH] kubernetes: Security fix for CVE-2023-3676 and CVE-2023-3955 vanusuri
2024-09-05 19:40 ` Bruce Ashfield
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.