CVE-2022-2879: golang - Unbounded Memory Allocation in Reader.Read
Summary
CVE-2022-2879: Unbounded memory consumption when reading headers in archive/tar. Affects golang across 2 version ranges.
< 1.18.7
>= 1.19.0, < 1.19.2
Fixed in 1.18.7 or 1.19.2, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2022-2879 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package is a popular open-source programming language that provides a robust and efficient environment for developing applications. It is widely used for its simplicity, performance, and extensive standard library. However, a vulnerability has been discovered in the package that could allow an attacker to cause resource exhaustion or panics by exploiting the Reader.Read function. This function does not set a limit on the maximum size of file headers, which could lead to unbounded memory allocation. This vulnerability affects versions 0.0.0 to 1.18.6 and 1.19.0 to 1.19.1 of the golang package.
Vulnerability Detail
The vulnerability (CVE-2022-2879) in the golang package arises from the lack of a limit on the maximum size of file headers in the Reader.Read function. An attacker can exploit this by crafting a malicious archive that causes the function to allocate unbounded amounts of memory. This can result in resource exhaustion or panics, leading to denial of service or potential code execution. To mitigate this issue, the Reader.Read function has been updated to limit the maximum size of header blocks to 1 MiB.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.18.71.18.7 -
>= 1.19.0, < 1.19.21.19.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed versions of the golang package to ensure the security of your application.
Conclusion
The golang package is vulnerable to an unbounded memory allocation issue in the Reader.Read function. This can be exploited by a malicious archive to cause resource exhaustion or panics. To mitigate this vulnerability, it is crucial to update the golang package to version 1.18.7 or 1.19.2. For more information and assistance, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
This vulnerability can lead to resource exhaustion or panics, potentially causing denial of service or code execution.
Versions 0.0.0 to 1.18.6 and 1.19.0 to 1.19.1 of the golang package are affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it in real-time.
No, there is no known workaround for this vulnerability. It is essential to update to the fixed versions of the golang package.
For more information about this vulnerability, you can refer to the official CVE-2022-2879 entry or reach out to info@devnack.com for further support.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
