Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

net/http, x/net/http2: Denial of Service vulnerabilities in the HTTP/2 implementation #33606

Closed
FiloSottile opened this issue Aug 12, 2019 · 4 comments
Closed

net/http, x/net/http2: Denial of Service vulnerabilities in the HTTP/2 implementation #33606

FiloSottile opened this issue Aug 12, 2019 · 4 comments
Labels
FrozenDueToAge Security

Comments

@FiloSottile
Copy link
Contributor

FiloSottile commented Aug 12, 2019 •
edited by dmitshur
Loading

net/http and golang.org/x/net/http2 servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. Servers will now close connections if the send queue accumulates too many control messages.

Thanks to Jonathan Looney from Netflix for discovering and reporting these issues.

These issues are CVE-2019-9512 and CVE-2019-9514.
@golang golang locked and limited conversation to collaborators Aug 12, 2019
@dmitshur dmitshur changed the title Placeholder issue net/http: Denial of Service vulnerabilities in the HTTP/2 implementation Aug 13, 2019
@golang golang unlocked this conversation Aug 13, 2019
@dmitshur
Copy link
Contributor

@gopherbot Please backport this to 1.12 and 1.11. This was a security problem.

This was referenced Aug 13, 2019
Closed
Closed
@gopherbot
Copy link
Contributor

Backport issue(s) opened: #33630 (for 1.11), #33631 (for 1.12).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://golang.org/wiki/MinorReleases.

gopherbot pushed a commit to golang/net that referenced this issue Aug 13, 2019
@FiloSottile
[release-branch.go1.12] http2: limit number of control frames in serv…
cdfb69a 
…er send queue

An attacker could cause servers to queue an unlimited number of PING
ACKs or RST_STREAM frames by soliciting them and not reading them, until
the program runs out of memory.

Limit control frames in the queue to a few thousands (matching the limit
imposed by other vendors) by counting as they enter and exit the scheduler,
so the protection will work with any WriteScheduler.

Once the limit is exceeded, close the connection, as we have no way to
communicate with the peer.

This addresses CVE-2019-9512 and CVE-2019-9514.

Updates golang/go#33606

Change-Id: I842968fc6ed3eac654b497ade8cea86f7267886b
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/525552
Reviewed-by: Brad Fitzpatrick <[email protected]>
(cherry picked from commit 589ad6cc5321fb68a90370348a241a5da0a2cc80)
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/526069
Reviewed-by: Dmitri Shuralyov <[email protected]>
gopherbot pushed a commit to golang/net that referenced this issue Aug 13, 2019
@FiloSottile
[release-branch.go1.11] http2: limit number of control frames in serv…
b1cc14a 
…er send queue

An attacker could cause servers to queue an unlimited number of PING
ACKs or RST_STREAM frames by soliciting them and not reading them, until
the program runs out of memory.

Limit control frames in the queue to a few thousands (matching the limit
imposed by other vendors) by counting as they enter and exit the scheduler,
so the protection will work with any WriteScheduler.

Once the limit is exceeded, close the connection, as we have no way to
communicate with the peer.

This addresses CVE-2019-9512 and CVE-2019-9514.

Updates golang/go#33606

Change-Id: I842968fc6ed3eac654b497ade8cea86f7267886b
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/525552
Reviewed-by: Brad Fitzpatrick <[email protected]>
(cherry picked from commit 589ad6cc5321fb68a90370348a241a5da0a2cc80)
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/526070
Reviewed-by: Dmitri Shuralyov <[email protected]>
gopherbot pushed a commit that referenced this issue Aug 13, 2019
@FiloSottile
[release-branch.go1.11-security] net/http: update bundled http2 to im…
e152b01 
…port security fix

Apply the following unpublished golang.org/x/net commit.

    commit b1cc14aba47abf96f96818003fa4caad3a4b4e86
    Author: Filippo Valsorda <[email protected]>
    Date:   Sun Aug 11 02:12:18 2019 -0400

    [release-branch.go1.11] http2: limit number of control frames in server send queue

    An attacker could cause servers to queue an unlimited number of PING
    ACKs or RST_STREAM frames by soliciting them and not reading them, until
    the program runs out of memory.

    Limit control frames in the queue to a few thousands (matching the limit
    imposed by other vendors) by counting as they enter and exit the scheduler,
    so the protection will work with any WriteScheduler.

    Once the limit is exceeded, close the connection, as we have no way to
    communicate with the peer.

    Change-Id: I842968fc6ed3eac654b497ade8cea86f7267886b
    Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/525552
    Reviewed-by: Brad Fitzpatrick <[email protected]>
    (cherry picked from commit 589ad6cc5321fb68a90370348a241a5da0a2cc80)
    Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/526070
    Reviewed-by: Dmitri Shuralyov <[email protected]>

Fixes CVE-2019-9512 and CVE-2019-9514
Updates #33606

Change-Id: Iecedf1cc63ec7a1cd75661ec591d91ebc911cc64
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/526072
Reviewed-by: Dmitri Shuralyov <[email protected]>
gopherbot pushed a commit that referenced this issue Aug 13, 2019
@FiloSottile
[release-branch.go1.12-security] net/http: update bundled http2 to im…
7139b45 
…port security fix

Apply the following unpublished golang.org/x/net commit.

    commit cdfb69ac37fc6fa907650654115ebebb3aae2087
    Author: Filippo Valsorda <[email protected]>
    Date:   Sun Aug 11 02:12:18 2019 -0400

    [release-branch.go1.12] http2: limit number of control frames in server send queue

    An attacker could cause servers to queue an unlimited number of PING
    ACKs or RST_STREAM frames by soliciting them and not reading them, until
    the program runs out of memory.

    Limit control frames in the queue to a few thousands (matching the limit
    imposed by other vendors) by counting as they enter and exit the scheduler,
    so the protection will work with any WriteScheduler.

    Once the limit is exceeded, close the connection, as we have no way to
    communicate with the peer.

    Change-Id: I842968fc6ed3eac654b497ade8cea86f7267886b
    Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/525552
    Reviewed-by: Brad Fitzpatrick <[email protected]>
    (cherry picked from commit 589ad6cc5321fb68a90370348a241a5da0a2cc80)
    Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/526069
    Reviewed-by: Dmitri Shuralyov <[email protected]>

Fixes CVE-2019-9512 and CVE-2019-9514
Updates #33606

Change-Id: I282b3e0fa22422d9ea0d07f4a3935685ce4a7433
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/526071
Reviewed-by: Dmitri Shuralyov <[email protected]>
@gopherbot
Copy link
Contributor

Change https://golang.org/cl/190137 mentions this issue: net/http: update bundled golang.org/x/net/http2 to import security fix

@dmitshur dmitshur changed the title net/http: Denial of Service vulnerabilities in the HTTP/2 implementation net/http, x/net/http2: Denial of Service vulnerabilities in the HTTP/2 implementation Aug 13, 2019
@matt-e matt-e mentioned this issue Aug 13, 2019
Closed
@cblecker cblecker mentioned this issue Aug 14, 2019
Merged
@mvladev mvladev mentioned this issue Aug 14, 2019
Merged
mvladev pushed a commit to mvladev/gardener that referenced this issue Aug 14, 2019
Upgrade golang to 1.12.8 due to multiple CVEs
a721b2a 
https://groups.google.com/forum/#!topic/golang-nuts/fCQWxqxP8aA
golang/go#33606
rfranzke pushed a commit to gardener/gardener that referenced this issue Aug 14, 2019
@rfranzke
Upgrade golang to 1.12.8 due to multiple CVEs
a9904b5 
https://groups.google.com/forum/#!topic/golang-nuts/fCQWxqxP8aA
golang/go#33606

```noteworthy developer
The golang version has been updated to `1.12.8` (fixing `CVE-2019-9512` and `CVE-2019-9514`).
```
artyom added a commit to artyom/tlstun that referenced this issue Aug 14, 2019
@artyom
Update x/net dependency
4ad64a5 
Addresses golang/go#33606
This was referenced Aug 16, 2019
Merged
Merged
@chappjc chappjc mentioned this issue Aug 16, 2019
Merged
@cblecker cblecker mentioned this issue Aug 17, 2019
Merged
@weppos weppos mentioned this issue Aug 20, 2019
Merged
@gopherbot
Copy link
Contributor

Change https://golang.org/cl/191618 mentions this issue: [release-branch.go1.13] net/http: update bundled golang.org/x/net/http2 to import security fix

gopherbot pushed a commit that referenced this issue Aug 23, 2019
@FiloSottile
net/http: update bundled golang.org/x/net/http2 to import security fix
145e193 
Update golang.org/x/net to v0.0.0-20190813141303-74dc4d7220e7 to import
the following security fix.

    commit 74dc4d7220e7acc4e100824340f3e66577424772
    Author: Filippo Valsorda <[email protected]>
    Date:   Sun Aug 11 02:12:18 2019 -0400

    http2: limit number of control frames in server send queue

    An attacker could cause servers to queue an unlimited number of PING
    ACKs or RST_STREAM frames by soliciting them and not reading them, until
    the program runs out of memory.

    Limit control frames in the queue to a few thousands (matching the limit
    imposed by other vendors) by counting as they enter and exit the scheduler,
    so the protection will work with any WriteScheduler.

    Once the limit is exceeded, close the connection, as we have no way to
    communicate with the peer.

    Change-Id: I842968fc6ed3eac654b497ade8cea86f7267886b
    Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/525552
    Reviewed-by: Brad Fitzpatrick <[email protected]>

This change was generated with cmd/go and cmd/bundle:

$ go get -u golang.org/x/net
$ go mod tidy
$ go mod vendor
$ go generate net/http

Fixes CVE-2019-9512 and CVE-2019-9514
Fixes #33606

Change-Id: I464baf96175006aa101d65d3b0f6494f28a626ab
Reviewed-on: https://go-review.googlesource.com/c/go/+/190137
Reviewed-by: Dmitri Shuralyov <[email protected]>
gopherbot pushed a commit that referenced this issue Aug 23, 2019
@FiloSottile
[release-branch.go1.13] net/http: update bundled golang.org/x/net/htt…
5c379a4 
…p2 to import security fix

Update golang.org/x/net to v0.0.0-20190813141303-74dc4d7220e7 to import
the following security fix.

    commit 74dc4d7220e7acc4e100824340f3e66577424772
    Author: Filippo Valsorda <[email protected]>
    Date:   Sun Aug 11 02:12:18 2019 -0400

    http2: limit number of control frames in server send queue

    An attacker could cause servers to queue an unlimited number of PING
    ACKs or RST_STREAM frames by soliciting them and not reading them, until
    the program runs out of memory.

    Limit control frames in the queue to a few thousands (matching the limit
    imposed by other vendors) by counting as they enter and exit the scheduler,
    so the protection will work with any WriteScheduler.

    Once the limit is exceeded, close the connection, as we have no way to
    communicate with the peer.

    Change-Id: I842968fc6ed3eac654b497ade8cea86f7267886b
    Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/525552
    Reviewed-by: Brad Fitzpatrick <[email protected]>

This change was generated with cmd/go and cmd/bundle:

$ go get -u golang.org/x/net
$ go mod tidy
$ go mod vendor
$ go generate net/http

Fixes CVE-2019-9512 and CVE-2019-9514
Fixes #33606

Change-Id: I464baf96175006aa101d65d3b0f6494f28a626ab
Reviewed-on: https://go-review.googlesource.com/c/go/+/190137
Reviewed-by: Dmitri Shuralyov <[email protected]>
(cherry picked from commit 145e193)
Reviewed-on: https://go-review.googlesource.com/c/go/+/191618
Run-TryBot: Filippo Valsorda <[email protected]>
TryBot-Result: Gobot Gobot <[email protected]>
@petersutter petersutter mentioned this issue Aug 26, 2019
Closed
@aaronbee aaronbee mentioned this issue Aug 27, 2019
Merged
t4n6a1ka pushed a commit to t4n6a1ka/go that referenced this issue Sep 5, 2019
@FiloSottile @t4n6a1ka
net/http: update bundled golang.org/x/net/http2 to import security fix
27f7d2d 
Update golang.org/x/net to v0.0.0-20190813141303-74dc4d7220e7 to import
the following security fix.

    commit 74dc4d7220e7acc4e100824340f3e66577424772
    Author: Filippo Valsorda <[email protected]>
    Date:   Sun Aug 11 02:12:18 2019 -0400

    http2: limit number of control frames in server send queue

    An attacker could cause servers to queue an unlimited number of PING
    ACKs or RST_STREAM frames by soliciting them and not reading them, until
    the program runs out of memory.

    Limit control frames in the queue to a few thousands (matching the limit
    imposed by other vendors) by counting as they enter and exit the scheduler,
    so the protection will work with any WriteScheduler.

    Once the limit is exceeded, close the connection, as we have no way to
    communicate with the peer.

    Change-Id: I842968fc6ed3eac654b497ade8cea86f7267886b
    Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/525552
    Reviewed-by: Brad Fitzpatrick <[email protected]>

This change was generated with cmd/go and cmd/bundle:

$ go get -u golang.org/x/net
$ go mod tidy
$ go mod vendor
$ go generate net/http

Fixes CVE-2019-9512 and CVE-2019-9514
Fixes golang#33606

Change-Id: I464baf96175006aa101d65d3b0f6494f28a626ab
Reviewed-on: https://go-review.googlesource.com/c/go/+/190137
Reviewed-by: Dmitri Shuralyov <[email protected]>
@golang golang locked and limited conversation to collaborators Aug 22, 2020
dteh pushed a commit to dteh/fhttp that referenced this issue Jun 22, 2022
@FiloSottile
http2: limit number of control frames in server send queue
06cf690 
An attacker could cause servers to queue an unlimited number of PING
ACKs or RST_STREAM frames by soliciting them and not reading them, until
the program runs out of memory.

Limit control frames in the queue to a few thousands (matching the limit
imposed by other vendors) by counting as they enter and exit the scheduler,
so the protection will work with any WriteScheduler.

Once the limit is exceeded, close the connection, as we have no way to
communicate with the peer.

This addresses CVE-2019-9512 and CVE-2019-9514.

Fixes golang/go#33606

Change-Id: I842968fc6ed3eac654b497ade8cea86f7267886b
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/525552
Reviewed-by: Brad Fitzpatrick <[email protected]>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge Security
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@FiloSottile @dmitshur @gopherbot