CVE-2022-30634: Infinite loop in Read in crypto/rand in golang
Summary
CVE-2022-30634: Indefinite hang with large buffers on Windows in crypto/rand. Affects golang across 2 version ranges.
< 1.17.11
>= 1.18.0, < 1.18.3
Fixed in 1.17.11 or 1.18.3, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2022-30634 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang (also known as Go) is an open-source programming language developed by Google. It is designed to be efficient, concise, and secure, making it suitable for a wide range of applications. The crypto/rand package in Golang provides a source of random numbers for cryptographic purposes. However, a vulnerability has been discovered in versions before Go 1.17.11 and Go 1.18.3 on Windows, which allows an attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.
Vulnerability Detail
The vulnerability in the crypto/rand package arises from an infinite loop in the Read function. When a buffer larger than the maximum allowed size is passed, the function enters an infinite loop, causing the program to hang indefinitely. This can be exploited by an attacker to disrupt the normal operation of affected applications. The severity of this vulnerability is rated as high.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.17.111.17.11 -
>= 1.18.0, < 1.18.31.18.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, developers can limit the size of the buffer passed to the Read function in the crypto/rand package. By ensuring that the buffer size does not exceed the maximum allowed value, the vulnerability can be mitigated. Here is an example of how to limit the buffer size:
definedMaxBufferSize := 1 << 32 - 1
buffer := make([]byte, definedMaxBufferSize)
if len(buffer) > definedMaxBufferSize {
buffer = buffer[:definedMaxBufferSize]
}
_, err := rand.Read(buffer)
if err != nil {
// Handle error
}
Conclusion
In summary, the crypto/rand package in Golang versions before Go 1.17.11 and Go 1.18.3 on Windows is vulnerable to an infinite loop issue, which can be exploited by an attacker to cause an indefinite hang in affected applications. To mitigate this vulnerability, it is crucial to update to the latest patched versions of Golang. Additionally, developers can apply a workaround to limit the buffer size passed to the Read function. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
This vulnerability allows an attacker to cause an indefinite hang in applications that use the crypto/rand package in affected versions of Golang on Windows. This can lead to denial of service and disruption of normal operations.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
No, only versions before Go 1.17.11 and Go 1.18.3 on Windows are affected by this vulnerability. It is recommended to update to the latest patched versions to mitigate the risk.
Yes, the vulnerability can be fixed by updating to Go version 1.17.11 or 1.18.3. These versions include the necessary patches to address the issue. Make sure to follow the official installation instructions specific to your operating system.
Yes, a workaround is available to limit the size of the buffer passed to the Read function in the crypto/rand package. By ensuring that the buffer size does not exceed the maximum allowed value, the vulnerability can be mitigated. Refer to the 'workaround' section for an example implementation.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
