CVE-2022-29526: Incorrect Privilege Assignment in golang
Summary
CVE-2022-29526: Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. Affects golang across 2 version ranges.
< 1.17.10
>= 1.18.0, < 1.18.2
Fixed in 1.17.10 or 1.18.2, depending on the release line you run. How to fix ↓
Also tracked for
- stdlib · Go
- golang.org/x/sys · Go
- golang.org/x/sys/unix · Go
- golang-1.15 · Debian:11
The same CVE-2022-29526 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang is an open-source programming language that is designed to be efficient, expressive, and safe. It is widely used for developing various applications and services. This vulnerability affects versions before 1.17.10 and 1.18.x before 1.18.2 of the Golang package. The Faccessat function in Golang, when called with a non-zero flags parameter, may incorrectly report that a file is accessible.
Vulnerability Detail
The vulnerability arises from an incorrect privilege assignment in the Faccessat function of Golang. When the function is called with a non-zero flags parameter, it may provide incorrect information about the accessibility of a file. This could lead to security issues, as applications relying on this function may make incorrect decisions based on the reported file accessibility. An attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive files or perform other malicious actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.17.101.17.10 -
>= 1.18.0, < 1.18.21.18.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Updating the Golang package to the fixed versions is the recommended solution.
Conclusion
The vulnerability in the Golang package (versions before 1.17.10 and 1.18.x before 1.18.2) allows for incorrect privilege assignment in the Faccessat function. This could lead to unauthorized access to sensitive files or other malicious actions. It is crucial to update the Golang package to the fixed versions to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
This vulnerability could allow an attacker to gain unauthorized access to sensitive files or perform other malicious actions by exploiting the incorrect privilege assignment in the Faccessat function.
No, only versions before 1.17.10 and 1.18.x before 1.18.2 are affected by this vulnerability.
There is no known exploit for this vulnerability at the moment.
No, updating the Golang package to the fixed versions is the recommended solution to mitigate this vulnerability.
You can find more information about this vulnerability in the official CVE entry: CVE-2022-29526.
Related vulnerabilities
Recent vulnerabilities recorded for golang.
