From 303f608ddf06ec256507b1a78f89da769d3f384c Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Sat, 5 Nov 2022 18:00:59 +0100 Subject: [PATCH] [release/1.6] update to Go 1.18.8 to address CVE-2022-41716 On Windows, syscall.StartProcess and os/exec.Cmd did not properly check for invalid environment variable values. A malicious environment variable value could exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" set the variables "A=B" and "C=D". Thanks to RyotaK (https://twitter.com/ryotkak) for reporting this issue. This is CVE-2022-41716 and Go issue https://go.dev/issue/56284. This Go release also fixes https://github.com/golang/go/issues/56309, a runtime bug which can cause random memory corruption when a goroutine exits with runtime.LockOSThread() set. This fix is necessary to unblock work to replace certain uses of pkg/reexec with unshared OS threads. Signed-off-by: Sebastiaan van Stijn --- .github/workflows/build-test-images.yml | 2 +- .github/workflows/ci.yml | 18 +++++++++--------- .github/workflows/codeql.yml | 2 +- .github/workflows/images.yml | 2 +- .github/workflows/nightly.yml | 4 ++-- .github/workflows/release.yml | 2 +- Vagrantfile | 2 +- contrib/Dockerfile.test | 2 +- script/setup/prepare_env_windows.ps1 | 2 +- 9 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/workflows/build-test-images.yml b/.github/workflows/build-test-images.yml index d8c21fcfe4f9..7818b7d73bf9 100644 --- a/.github/workflows/build-test-images.yml +++ b/.github/workflows/build-test-images.yml @@ -39,7 +39,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.7' + go-version: '1.18.8' - uses: actions/checkout@v2 with: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4561eb2d9ce4..317bc2abe0df 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,7 +20,7 @@ jobs: strategy: matrix: - go-version: [1.18.7] + go-version: [1.18.8] os: [ubuntu-18.04, macos-12, windows-2019] steps: @@ -46,7 +46,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.7' + go-version: '1.18.8' - uses: actions/checkout@v2 with: @@ -78,7 +78,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.7' + go-version: '1.18.8' - uses: actions/checkout@v2 with: @@ -110,7 +110,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.7' + go-version: '1.18.8' - uses: actions/checkout@v2 - run: go install github.com/cpuguy83/go-md2man/v2@v2.0.1 - run: make man @@ -148,7 +148,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.7' + go-version: '1.18.8' - uses: actions/checkout@v2 - run: | set -e -x @@ -215,7 +215,7 @@ jobs: strategy: matrix: os: [ubuntu-18.04, macos-12, windows-2019, windows-2022] - go-version: ['1.17.13', '1.18.7'] + go-version: ['1.17.13', '1.18.8'] steps: - uses: actions/setup-go@v2 @@ -262,7 +262,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.7' + go-version: '1.18.8' - uses: actions/checkout@v2 with: @@ -352,7 +352,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.7' + go-version: '1.18.8' - uses: actions/checkout@v2 @@ -475,7 +475,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.7' + go-version: '1.18.8' - uses: actions/checkout@v2 - run: sudo -E PATH=$PATH script/setup/install-gotestsum - name: Tests diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f3a12dcd0ec5..5cdb1a801fc1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -26,7 +26,7 @@ jobs: - uses: actions/setup-go@v2 with: - go-version: 1.18.7 + go-version: 1.18.8 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml index f497af083106..32cdca34c912 100644 --- a/.github/workflows/images.yml +++ b/.github/workflows/images.yml @@ -24,7 +24,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.7' + go-version: '1.18.8' - uses: actions/checkout@v2 with: diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index f07184237667..4fb7c70aa357 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -18,7 +18,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.7' + go-version: '1.18.8' - uses: actions/checkout@v2 with: @@ -155,7 +155,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.7' + go-version: '1.18.8' - uses: actions/checkout@v2 with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9b5c3d21cc36..effb89daada1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -111,7 +111,7 @@ jobs: find ./releases/ -maxdepth 1 -type l | xargs rm working-directory: src/github.com/containerd/containerd env: - GO_VERSION: '1.18.7' + GO_VERSION: '1.18.8' PLATFORM: ${{ matrix.platform }} - name: Save Artifacts uses: actions/upload-artifact@v2 diff --git a/Vagrantfile b/Vagrantfile index 9f8259970431..8e2dac146e5d 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -91,7 +91,7 @@ EOF config.vm.provision "install-golang", type: "shell", run: "once" do |sh| sh.upload_path = "/tmp/vagrant-install-golang" sh.env = { - 'GO_VERSION': ENV['GO_VERSION'] || "1.18.7", + 'GO_VERSION': ENV['GO_VERSION'] || "1.18.8", } sh.inline = <<~SHELL #!/usr/bin/env bash diff --git a/contrib/Dockerfile.test b/contrib/Dockerfile.test index 3da88a82dd8d..86e76fc43657 100644 --- a/contrib/Dockerfile.test +++ b/contrib/Dockerfile.test @@ -10,7 +10,7 @@ # # docker build -t containerd-test --build-arg RUNC_VERSION=v1.0.0-rc94 -f Dockerfile.test ../ -ARG GOLANG_VERSION=1.18.7 +ARG GOLANG_VERSION=1.18.8 ARG GOLANG_IMAGE=golang FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang diff --git a/script/setup/prepare_env_windows.ps1 b/script/setup/prepare_env_windows.ps1 index 412705a20884..858969af578a 100644 --- a/script/setup/prepare_env_windows.ps1 +++ b/script/setup/prepare_env_windows.ps1 @@ -1,6 +1,6 @@ # Prepare windows environment for building and running containerd tests -$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.18.7"; make = ""; nssm = "" } +$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.18.8"; make = ""; nssm = "" } Write-Host "Downloading chocolatey package" curl.exe -L "https://packages.chocolatey.org/chocolatey.0.10.15.nupkg" -o 'c:\choco.zip'