From 7e4efab6ada096f3d9a2a0483573aec7747f5265 Mon Sep 17 00:00:00 2001 From: Peter Hunt Date: Tue, 7 Jun 2022 14:43:31 -0400 Subject: [PATCH] cri-api: document expectation of 16 MB limit to conform with decisions made to mitigate CVE-2022-31030 and CVE-2022-1708 Signed-off-by: Peter Hunt --- staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.pb.go | 8 ++++++++ staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.pb.go b/staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.pb.go index b8be0069bb0..ca2e768b955 100644 --- a/staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.pb.go +++ b/staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.pb.go @@ -6127,8 +6127,16 @@ func (m *ExecSyncRequest) GetTimeout() int64 { type ExecSyncResponse struct { // Captured command stdout output. + // The runtime should cap the output of this response to 16MB. + // If the stdout of the command produces more than 16MB, the remaining output + // should be discarded, and the command should proceed with no error. + // See CVE-2022-1708 and CVE-2022-31030 for more information. Stdout []byte `protobuf:"bytes,1,opt,name=stdout,proto3" json:"stdout,omitempty"` // Captured command stderr output. + // The runtime should cap the output of this response to 16MB. + // If the stderr of the command produces more than 16MB, the remaining output + // should be discarded, and the command should proceed with no error. + // See CVE-2022-1708 and CVE-2022-31030 for more information. Stderr []byte `protobuf:"bytes,2,opt,name=stderr,proto3" json:"stderr,omitempty"` // Exit code the command finished with. Default: 0 (success). ExitCode int32 `protobuf:"varint,3,opt,name=exit_code,json=exitCode,proto3" json:"exit_code,omitempty"` diff --git a/staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto b/staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto index 83a7ac31215..c7eca7068e7 100644 --- a/staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto +++ b/staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto @@ -1279,8 +1279,16 @@ message ExecSyncRequest { message ExecSyncResponse { // Captured command stdout output. + // The runtime should cap the output of this response to 16MB. + // If the stdout of the command produces more than 16MB, the remaining output + // should be discarded, and the command should proceed with no error. + // See CVE-2022-1708 and CVE-2022-31030 for more information. bytes stdout = 1; // Captured command stderr output. + // The runtime should cap the output of this response to 16MB. + // If the stderr of the command produces more than 16MB, the remaining output + // should be discarded, and the command should proceed with no error. + // See CVE-2022-1708 and CVE-2022-31030 for more information. bytes stderr = 2; // Exit code the command finished with. Default: 0 (success). int32 exit_code = 3;