Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

net/http: memory exhaustion in Request.ParseMultipartForm [CVE-2023-45290] #65383

Closed
neild opened this issue Jan 30, 2024 · 8 comments
Closed

net/http: memory exhaustion in Request.ParseMultipartForm [CVE-2023-45290] #65383

neild opened this issue Jan 30, 2024 · 8 comments
Assignees
@neild
Labels
release-blocker Security
Milestone
Go1.23

Comments

@neild
Copy link
Contributor

neild commented Jan 30, 2024 •
edited by mknyszek
Loading

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permitted a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion.

ParseMultipartForm now correctly limits the maximum size of form lines.

Thanks to Bartek Nowotarski for reporting this issue. This is CVE-2023-45290.
@neild neild self-assigned this Jan 30, 2024
@neild neild added this to the Go1.22 milestone Jan 30, 2024
@neild
Copy link
Contributor Author

neild commented Jan 30, 2024

@gopherbot please open backport issues for this security fix.

This was referenced Jan 30, 2024
Closed
Closed
@gopherbot
Copy link
Contributor

Backport issue(s) opened: #65388 (for 1.20), #65389 (for 1.21).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

@mknyszek mknyszek modified the milestones: Go1.22, Go1.23 Feb 2, 2024
@mknyszek
Copy link
Contributor

mknyszek commented Feb 2, 2024

@gopherbot Please open a backport issue for Go 1.22 as well.

@dmitshur
Copy link
Contributor

dmitshur commented Feb 2, 2024

@mknyszek gopherbot is sorry but it can't do that yet: #25574.

@mknyszek
Copy link
Contributor

mknyszek commented Feb 2, 2024

I'll leave a note for the next release rotation person to do this after the release goes out, so it doesn't get lost.

@neild neild mentioned this issue Feb 21, 2024
Closed
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/569237 mentions this issue: [release-branch.go1.22] net/textproto, mime/multipart: avoid unbounded read in MIME header

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/569240 mentions this issue: [release-branch.go1.21] net/textproto, mime/multipart: avoid unbounded read in MIME header

gopherbot pushed a commit that referenced this issue Mar 5, 2024
@neild @gopherbot
[release-branch.go1.22] net/textproto, mime/multipart: avoid unbounde…
041a477 
…d read in MIME header

mime/multipart.Reader.ReadForm allows specifying the maximum amount
of memory that will be consumed by the form. While this limit is
correctly applied to the parsed form data structure, it was not
being applied to individual header lines in a form.

For example, when presented with a form containing a header line
that never ends, ReadForm will continue to read the line until it
runs out of memory.

Limit the amount of data consumed when reading a header.

Fixes CVE-2023-45290
Fixes #65850
For #65383

Change-Id: I7f9264d25752009e95f6b2c80e3d76aaf321d658
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2134435
Reviewed-by: Roland Shoemaker <[email protected]>
Reviewed-by: Tatiana Bradley <[email protected]>
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2174345
Reviewed-by: Carlos Amedee <[email protected]>
Reviewed-on: https://go-review.googlesource.com/c/go/+/569237
Reviewed-by: Carlos Amedee <[email protected]>
LUCI-TryBot-Result: Go LUCI <[email protected]>
Auto-Submit: Michael Knyszek <[email protected]>
gopherbot pushed a commit that referenced this issue Mar 5, 2024
@neild @gopherbot
[release-branch.go1.21] net/textproto, mime/multipart: avoid unbounde…
bf80213 
…d read in MIME header

mime/multipart.Reader.ReadForm allows specifying the maximum amount
of memory that will be consumed by the form. While this limit is
correctly applied to the parsed form data structure, it was not
being applied to individual header lines in a form.

For example, when presented with a form containing a header line
that never ends, ReadForm will continue to read the line until it
runs out of memory.

Limit the amount of data consumed when reading a header.

Fixes CVE-2023-45290
Fixes #65389
For #65383

Change-Id: I7f9264d25752009e95f6b2c80e3d76aaf321d658
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2134435
Reviewed-by: Roland Shoemaker <[email protected]>
Reviewed-by: Tatiana Bradley <[email protected]>
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2173776
Reviewed-by: Carlos Amedee <[email protected]>
Reviewed-on: https://go-review.googlesource.com/c/go/+/569240
Auto-Submit: Michael Knyszek <[email protected]>
LUCI-TryBot-Result: Go LUCI <[email protected]>
Reviewed-by: Carlos Amedee <[email protected]>
@mknyszek mknyszek changed the title security: fix CVE-2023-45290 net/http: memory exhaustion in Request.ParseMultipartForm [CVE-2023-45290] Mar 5, 2024
bradfitz pushed a commit to tailscale/go that referenced this issue Mar 5, 2024
@neild @bradfitz
[release-branch.go1.22] net/textproto, mime/multipart: avoid unbounde…
56c3d20 
…d read in MIME header

mime/multipart.Reader.ReadForm allows specifying the maximum amount
of memory that will be consumed by the form. While this limit is
correctly applied to the parsed form data structure, it was not
being applied to individual header lines in a form.

For example, when presented with a form containing a header line
that never ends, ReadForm will continue to read the line until it
runs out of memory.

Limit the amount of data consumed when reading a header.

Fixes CVE-2023-45290
Fixes golang#65850
For golang#65383

Change-Id: I7f9264d25752009e95f6b2c80e3d76aaf321d658
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2134435
Reviewed-by: Roland Shoemaker <[email protected]>
Reviewed-by: Tatiana Bradley <[email protected]>
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2174345
Reviewed-by: Carlos Amedee <[email protected]>
Reviewed-on: https://go-review.googlesource.com/c/go/+/569237
Reviewed-by: Carlos Amedee <[email protected]>
LUCI-TryBot-Result: Go LUCI <[email protected]>
Auto-Submit: Michael Knyszek <[email protected]>
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/569341 mentions this issue: net/textproto, mime/multipart: avoid unbounded read in MIME header

romaindoumenc pushed a commit to TroutSoftware/go that referenced this issue Mar 6, 2024
@neild @romaindoumenc
[release-branch.go1.22] net/textproto, mime/multipart: avoid unbounde…
c1324bf 
…d read in MIME header

mime/multipart.Reader.ReadForm allows specifying the maximum amount
of memory that will be consumed by the form. While this limit is
correctly applied to the parsed form data structure, it was not
being applied to individual header lines in a form.

For example, when presented with a form containing a header line
that never ends, ReadForm will continue to read the line until it
runs out of memory.

Limit the amount of data consumed when reading a header.

Fixes CVE-2023-45290
Fixes golang#65850
For golang#65383

Change-Id: I7f9264d25752009e95f6b2c80e3d76aaf321d658
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2134435
Reviewed-by: Roland Shoemaker <[email protected]>
Reviewed-by: Tatiana Bradley <[email protected]>
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2174345
Reviewed-by: Carlos Amedee <[email protected]>
Reviewed-on: https://go-review.googlesource.com/c/go/+/569237
Reviewed-by: Carlos Amedee <[email protected]>
LUCI-TryBot-Result: Go LUCI <[email protected]>
Auto-Submit: Michael Knyszek <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@neild neild

Labels
release-blocker Security
Projects
None yet
Milestone
Go1.23
Development

No branches or pull requests
4 participants
@neild @mknyszek @dmitshur @gopherbot