CVE-2024-34156: Stack Exhaustion Vulnerability in golang
Summary
CVE-2024-34156: Stack exhaustion in Decoder.Decode in encoding/gob. Affects golang across 2 version ranges.
< 1.22.7
>= 1.23.0-0, < 1.23.1
Fixed in 1.22.7 or 1.23.1, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2024-34156 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang is an open-source programming language that is widely used for developing efficient and reliable software. It offers features like garbage collection, strong typing, and built-in concurrency support. However, a vulnerability has been discovered in golang that can lead to a stack exhaustion issue when decoding deeply nested structures. This vulnerability is a follow-up to CVE-2022-30635.
Vulnerability Detail
The vulnerability arises when Decoder.Decode is called on a message containing deeply nested structures. This can cause a panic due to stack exhaustion, potentially leading to a denial-of-service (DoS) situation. Attackers could exploit this vulnerability to crash applications or services that utilize golang's decoding functionality. The severity of this vulnerability is rated as high.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.22.71.22.7 -
>= 1.23.0-0, < 1.23.11.23.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, developers can modify the code to limit the depth of nested structures during decoding. By setting a maximum depth threshold, the risk of stack exhaustion can be mitigated. Here's an example of how to implement this workaround in golang:
import (
"encoding/json"
"fmt"
)
func main() {
decoder := json.NewDecoder(input)
decoder.MaxDepth = 10 // Set the maximum depth threshold
var data interface{}
err := decoder.Decode(&data)
if err != nil {
fmt.Println("Error: ", err)
}
}
Conclusion
In conclusion, golang is susceptible to a stack exhaustion vulnerability when decoding deeply nested structures. This can lead to a denial-of-service situation and potential application crashes. It is crucial to update the golang package to the recommended versions or apply the provided workaround to mitigate the risk.
See every vulnerability recorded for golang →
FAQ
The vulnerability can result in a denial-of-service (DoS) situation by causing a panic due to stack exhaustion. This can lead to application crashes or unavailability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will provide real-time alerts for open-source vulnerabilities.
Yes, updating the golang package to version 1.22.7 or later will fix the stack exhaustion vulnerability. For versions 1.23.0-0 and above, upgrading to version 1.23.1 or later is recommended.
Developers can implement a workaround by limiting the depth of nested structures during decoding. By setting a maximum depth threshold, the risk of stack exhaustion can be reduced.
The severity of this vulnerability is rated as high.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
