Bug 2237778 (CVE-2023-39322)

Summary:	CVE-2023-39322 golang: crypto/tls: lack of a limit on buffered post-handshake
Product:	[Other] Security Response	Reporter:	Patrick Del Bello <pdelbell>
Component:	vulnerability	Assignee:	Sayan Biswas <sabiswas>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aazores, abishop, adudiak, aileenc, amasferr, amctagga, ansmith, aoconnor, apjagtap, asatyam, askrabec, aveerama, bbuckingham, bcourt, bdettelb, bniver, bodavis, chazlett, davidn, dbenoit, dcadzow, dfreiber, diagrawa, dkenigsb, dperaza, dsimansk, dymurray, eaguilar, ebaron, eglynn, ehelms, emachado, epacific, eric.wittmann, fdeutsch, flucifre, gmeno, gparvin, ibolton, jaharrin, janstey, jburrell, jcammara, jcantril, jchui, jeder, jhardy, jjoyce, jkang, jkoehler, jmatthew, jmontleo, jneedle, jobarker, jpallich, jschluet, jsherril, jwendell, kaycoth, kshier, lball, lhh, lmadsen, lzap, mabashia, matzew, mbenjamin, mburns, mcressma, mgarciac, mhackett, mhulan, mkudlej, mmagr, mnewsome, mrajanna, mrunge, mwringe, njean, nmoumoul, nobody, odf-bz-bot, orabin, oramraz, osapryki, owatkins, pahickey, pantinor, pcreech, peholase, periklis, pgrist, pjindal, rcernich, rchan, rhos-maint, rhuss, rjohnson, rogbas, saroy, sdawley, sfroberg, sgott, shbose, simaishi, sipoyare, skontopo, slucidi, smcdonal, smullick, sostapov, sseago, stcannon, teagle, tfister, tjochec, twalsh, ubhargav, vereddy, vkumar, whayutin, yguenane, zsadeh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	golang 1.20.8, golang 1.21.1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Golang. QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With the fix, connections now consistently reject messages larger than 65KiB in size.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2238077, 2238078, 2238079, 2238080, 2238084, 2238085, 2238086, 2238064, 2238065, 2238066, 2238067, 2238068, 2238069, 2238070, 2238071, 2238072, 2238073, 2238074, 2238075, 2238076, 2238081, 2238082, 2238083, 2238088, 2238089, 2238090, 2238091, 2238092, 2238093, 2238094, 2238095, 2238811, 2238812, 2280689
Bug Blocks:	2237770

Description Patrick Del Bello 2023-09-06 20:24:39 UTC

Once the TLS handshake completes, QUICConn.HandleData buffers data and passes it to handlePostHandshakeMessage every time the buffer contains a complete message. The size check is wrong, however, so it can pass along a partial message, triggering a panic when handlePostHandshakeMessage tries to read the remainder of the message.

In addition, HandleData doesn't limit the amount of data it can buffer. It should reject messages larger than maxHandshake.

Comment 8 Anten Skrabec 2023-09-13 17:23:55 UTC

Created golang tracking bugs for this issue:

Affects: epel-all [bug 2238811]
Affects: fedora-all [bug 2238812]

Comment 12 errata-xmlrpc 2023-10-20 16:50:09 UTC

This issue has been addressed in the following products:

  NETWORK-OBSERVABILITY-1.4.0-RHEL-9

Via RHSA-2023:5974 https://access.redhat.com/errata/RHSA-2023:5974

Comment 13 errata-xmlrpc 2023-10-23 14:24:47 UTC

This issue has been addressed in the following products:

  Cryostat 2 on RHEL 8

Via RHSA-2023:6031 https://access.redhat.com/errata/RHSA-2023:6031

Comment 14 errata-xmlrpc 2023-10-24 15:32:54 UTC

This issue has been addressed in the following products:

  Red Hat Openshift distributed tracing 2.9

Via RHSA-2023:6085 https://access.redhat.com/errata/RHSA-2023:6085

Comment 15 errata-xmlrpc 2023-10-25 14:02:16 UTC

This issue has been addressed in the following products:

  OADP-1.1-RHEL-8

Via RHSA-2023:6115 https://access.redhat.com/errata/RHSA-2023:6115

Comment 16 errata-xmlrpc 2023-10-25 15:52:58 UTC

This issue has been addressed in the following products:

  multicluster engine for Kubernetes 2.3 for RHEL 8

Via RHSA-2023:6119 https://access.redhat.com/errata/RHSA-2023:6119

Comment 17 errata-xmlrpc 2023-10-25 18:15:24 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.8 for RHEL 8

Via RHSA-2023:6122 https://access.redhat.com/errata/RHSA-2023:6122

Comment 18 errata-xmlrpc 2023-10-26 00:48:02 UTC

This issue has been addressed in the following products:

  RODOO-1.0-RHEL-8

Via RHSA-2023:5947 https://access.redhat.com/errata/RHSA-2023:5947

Comment 19 errata-xmlrpc 2023-10-26 18:18:23 UTC

This issue has been addressed in the following products:

  multicluster engine for Kubernetes 2.2 for RHEL 8

Via RHSA-2023:6145 https://access.redhat.com/errata/RHSA-2023:6145

Comment 20 errata-xmlrpc 2023-10-26 19:20:32 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.7 for RHEL 8

Via RHSA-2023:6148 https://access.redhat.com/errata/RHSA-2023:6148

Comment 21 errata-xmlrpc 2023-10-30 02:16:33 UTC

This issue has been addressed in the following products:

  Red Hat Migration Toolkit for Containers 1.7

Via RHSA-2023:6161 https://access.redhat.com/errata/RHSA-2023:6161

Comment 22 errata-xmlrpc 2023-10-30 18:15:35 UTC

This issue has been addressed in the following products:

  multicluster engine for Kubernetes 2.1 for RHEL 8

Via RHSA-2023:6200 https://access.redhat.com/errata/RHSA-2023:6200

Comment 23 errata-xmlrpc 2023-10-30 20:14:31 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8

Via RHSA-2023:6202 https://access.redhat.com/errata/RHSA-2023:6202

Comment 24 errata-xmlrpc 2023-10-31 14:02:17 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2023:5009 https://access.redhat.com/errata/RHSA-2023:5009

Comment 25 errata-xmlrpc 2023-11-01 00:30:47 UTC

This issue has been addressed in the following products:

  OSSO-1.2-RHEL-8

Via RHSA-2023:6154 https://access.redhat.com/errata/RHSA-2023:6154

Comment 26 errata-xmlrpc 2023-11-15 04:38:16 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2023:6840 https://access.redhat.com/errata/RHSA-2023:6840

Comment 27 errata-xmlrpc 2023-11-27 19:27:55 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.4 for RHEL 8
  Red Hat Ansible Automation Platform 2.4 for RHEL 9

Via RHSA-2023:7517 https://access.redhat.com/errata/RHSA-2023:7517

Comment 28 errata-xmlrpc 2023-12-12 17:23:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:7762 https://access.redhat.com/errata/RHSA-2023:7762

Comment 29 errata-xmlrpc 2023-12-12 17:23:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:7764 https://access.redhat.com/errata/RHSA-2023:7764

Comment 30 errata-xmlrpc 2023-12-12 17:23:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:7765 https://access.redhat.com/errata/RHSA-2023:7765

Comment 31 errata-xmlrpc 2023-12-12 17:24:34 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:7763 https://access.redhat.com/errata/RHSA-2023:7763

Comment 32 errata-xmlrpc 2023-12-12 17:24:56 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:7766 https://access.redhat.com/errata/RHSA-2023:7766

Comment 33 errata-xmlrpc 2024-01-10 11:28:27 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:0121 https://access.redhat.com/errata/RHSA-2024:0121

Comment 34 errata-xmlrpc 2024-04-18 07:18:33 UTC

This issue has been addressed in the following products:

  Service Interconnect 1 for RHEL 9

Via RHSA-2024:1901 https://access.redhat.com/errata/RHSA-2024:1901

Comment 37 errata-xmlrpc 2024-05-22 09:27:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:2988 https://access.redhat.com/errata/RHSA-2024:2988

Comment 38 errata-xmlrpc 2024-05-23 15:25:01 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.2

Via RHSA-2024:3352 https://access.redhat.com/errata/RHSA-2024:3352

Comment 39 errata-xmlrpc 2024-05-29 13:31:29 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.1

Via RHSA-2024:3467 https://access.redhat.com/errata/RHSA-2024:3467