CVE-2024-34155: Stack exhaustion in all Parse functions in go/parser

Background

The stdlib package in the Go ecosystem provides a collection of standard libraries for the Go programming language. It includes various modules and functions that enable developers to build robust and efficient applications. One of the packages within the stdlib is go/parser, which offers parsing functionality for Go source code. This package is responsible for parsing Go source code and extracting relevant information for further processing.

Vulnerability Detail

The vulnerability identified as CVE-2024-34155 affects all Parse functions in the go/parser package. When any of these functions are called on Go source code containing deeply nested literals, it can lead to a panic due to stack exhaustion. This vulnerability arises from the inability of the parser to handle excessively nested literals, causing the stack to overflow and resulting in a panic. The impact of this vulnerability can range from application crashes to potential remote code execution if the panic is not properly handled.

go get stdlib@vgo1.25.5

Workaround

As a temporary workaround, developers can manually limit the depth of nested literals in their Go source code to avoid triggering the stack exhaustion. This can be achieved by refactoring the code to reduce the nesting level or by splitting complex literals into smaller, more manageable parts. Here is an example of how to limit the nesting depth:

package main

import (
	"go/parser"
	"go/token"
)

func main() {
	fset := token.NewFileSet()

	// Limit the nesting depth to 10
	f, err := parser.ParseFile(fset, "example.go", nil, parser.ParseComments, 10)
	if err != nil {
		panic(err)
	}

	// Rest of the code
}

Conclusion

The vulnerability identified as CVE-2024-34155 in the go/parser package can lead to stack exhaustion when parsing Go source code with deeply nested literals. This can result in application crashes or potential remote code execution. It is crucial to update the affected package to version 1.23.1 or later to mitigate this vulnerability. Additionally, developers can apply a temporary workaround by limiting the depth of nested literals in their code.

See every vulnerability recorded for stdlib →

FAQ