CVE-2024-34155: Stack Exhaustion Vulnerability in golang
Summary
CVE-2024-34155: Stack exhaustion in all Parse functions in go/parser. Affects golang across 2 version ranges.
< 1.22.7
>= 1.23.0-0, < 1.23.1
Fixed in 1.22.7 or 1.23.1, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2024-34155 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang, also known as Go, is an open-source programming language developed by Google. It is designed for building efficient, reliable, and scalable software. Golang is widely used for various applications, including web development, network programming, and system tools. However, a vulnerability has been discovered in certain versions of golang that can lead to a stack exhaustion panic when parsing deeply nested literals in Go source code.
Vulnerability Detail
The vulnerability, identified as CVE-2024-34155, arises when any of the Parse functions are called on Go source code containing deeply nested literals. This can cause a stack exhaustion panic, leading to a crash or unexpected termination of the program. The issue stems from the inability of the parser to handle excessively nested structures, resulting in a stack overflow. If exploited, this vulnerability could be leveraged by an attacker to disrupt the functioning of affected applications or potentially execute arbitrary code.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.22.71.22.7 -
>= 1.23.0-0, < 1.23.11.23.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can modify the Go source code to reduce the depth of nested literals. By refactoring the code to avoid excessive nesting, the risk of triggering a stack exhaustion panic can be minimized. Here's an example of how the code can be modified:
// Before
var nestedLiteral = [][][]int{{{1, 2}, {3, 4}}, {{5, 6}, {7, 8}}}
// After
var nestedLiteral = [][]int{{1, 2}, {3, 4}, {5, 6}, {7, 8}}
Conclusion
In conclusion, the stack exhaustion vulnerability in golang can lead to program crashes or unexpected terminations when parsing deeply nested literals. It is crucial for developers to update their golang packages to the latest patched versions to mitigate this issue. Additionally, refactoring the code to reduce the depth of nested literals can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for golang →
FAQ
The vulnerability can lead to a stack exhaustion panic, causing the affected program to crash or terminate unexpectedly. This can result in service disruptions, data loss, or potential exploitation by attackers.
The vulnerability affects golang versions 0.0.0 to 1.22.6, as well as versions 1.23.0-0 and 1.23.1. It is recommended to update to version 1.22.7 or later to mitigate the issue.
No, this vulnerability does not allow remote exploitation. An attacker would need to have the ability to execute Go source code containing deeply nested literals on the affected system.
There are no known instances of this vulnerability being actively exploited in the wild at this time.
Yes, this vulnerability is identified as CVE-2024-34155.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
