CVE-2022-30635: Uncontrolled Recursion in encoding/gob in golang
Summary
CVE-2022-30635: Stack exhaustion when decoding certain messages in encoding/gob. Affects golang across 2 version ranges.
< 1.17.12
>= 1.18.0, < 1.18.4
Fixed in 1.17.12 or 1.18.4, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2022-30635 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package is a popular open-source programming language that provides a robust set of tools and libraries for building scalable and efficient applications. It is widely used for its simplicity, performance, and concurrency features. However, a vulnerability has been discovered in the encoding/gob package of golang, which can lead to a panic due to stack exhaustion when decoding deeply nested structures.
Vulnerability Detail
The vulnerability (CVE-2022-30635) originates from uncontrolled recursion in the Decoder.Decode function of the encoding/gob package in golang. An attacker can exploit this issue by crafting a message that contains deeply nested structures. When the decoder attempts to decode this message, it triggers uncontrolled recursion, eventually exhausting the stack and causing a panic. This vulnerability can be exploited remotely, potentially leading to denial of service (DoS) attacks or the execution of arbitrary code.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.17.121.17.12 -
>= 1.18.0, < 1.18.41.18.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, developers can implement input validation and limit the depth of nested structures during decoding. By enforcing a maximum depth for decoding operations, the risk of triggering uncontrolled recursion can be mitigated. Here is an example of how to limit the depth using the encoding/gob package:
func decodeWithMaxDepth(data []byte, maxDepth int) (interface{}, error) {
decoder := gob.NewDecoder(bytes.NewReader(data))
decoder.MaxDepth = maxDepth
var decodedData interface{}
err := decoder.Decode(&decodedData)
if err != nil {
return nil, err
}
return decodedData, nil
}
In this example, the MaxDepth property of the decoder is set to the desired maximum depth. This ensures that decoding operations will stop when the specified depth is reached, preventing uncontrolled recursion.
Conclusion
In conclusion, the golang package is vulnerable to uncontrolled recursion in the encoding/gob package, which can lead to stack exhaustion and a panic. It is crucial to update to the fixed versions (1.17.12 or 1.18.4) or implement the provided workaround to mitigate the risk. Regularly monitoring for vulnerabilities using tools like Vulert can also help ensure the security of your applications. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for golang →
FAQ
This vulnerability can lead to a denial of service (DoS) condition or the execution of arbitrary code. An attacker can exploit this issue remotely by sending a specially crafted message containing deeply nested structures.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to apply the recommended fixes to prevent potential attacks.
No, not all versions of the golang package are affected. Versions before 1.17.12 and 1.18.4 are vulnerable to this issue. It is recommended to update to the fixed versions to mitigate the risk.
Yes, developers can implement input validation and limit the depth of nested structures during decoding to mitigate the risk of triggering uncontrolled recursion. The provided workaround in this report demonstrates how to enforce a maximum depth for decoding operations.
For more information about this vulnerability, you can refer to the official CVE-2022-30635 entry or the Bitnami vulnerability database, which provides detailed information and remediation steps.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
