CVE-2023-24537: Vulnerability in golang package - Infinite Loop due to Integer Overflow
Summary
CVE-2023-24537: Infinite loop in parsing in go/scanner. Affects golang across 2 version ranges.
< 1.19.8
>= 1.20.0, < 1.20.3
Fixed in 1.19.8 or 1.20.3, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2023-24537 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package is a popular open-source programming language that is widely used for developing efficient and scalable applications. It provides a rich set of libraries and tools for building various types of software. However, a vulnerability has been discovered in the package that can lead to an infinite loop due to an integer overflow when parsing Go source code containing line directives with very large line numbers.
Vulnerability Detail
The vulnerability in the golang package arises from an integer overflow issue when processing line directives with extremely large line numbers. This can cause an infinite loop, leading to a denial of service (DoS) condition. An attacker can exploit this vulnerability by crafting malicious Go source code with specially crafted line directives. If successfully exploited, this vulnerability can result in the consumption of excessive system resources, potentially leading to system instability or unresponsiveness.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.19.81.19.8 -
>= 1.20.0, < 1.20.31.20.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is currently no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the golang package to the patched versions.
Conclusion
The golang package is susceptible to an integer overflow vulnerability that can result in an infinite loop when processing line directives with extremely large line numbers. This can lead to a denial of service condition and the consumption of excessive system resources. It is crucial to update the golang package to the recommended patched versions to mitigate the risk of exploitation. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
This vulnerability can lead to an infinite loop, causing a denial of service (DoS) condition. It can result in the consumption of excessive system resources, potentially leading to system instability or unresponsiveness.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
While there is no known public exploit for this vulnerability at the moment, it is still crucial to apply the recommended fix to mitigate the risk of potential exploitation.
Yes, this vulnerability can be remotely exploited by an attacker who can provide malicious Go source code with specially crafted line directives.
No, there are no specific prerequisites for exploiting this vulnerability. However, the attacker needs to be able to provide Go source code with line directives containing very large line numbers.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
