CVE-2022-2879: stdlib - Unbounded Memory Consumption in archive/tar
Summary
CVE-2022-2879: Reader.Read does not set a limit on the maximum size of file headers. Affects golang-1.15 versions < 947091d31ccda14b0a362adff37b6e037f0f59f3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package is a part of the Go programming language standard library. It provides a collection of modules and functions that are commonly used in Go programs. The archive/tar package in stdlib allows reading and writing of tar archives. It is used for creating and extracting tar files in various applications.
Vulnerability Detail
The vulnerability identified as CVE-2022-2879 affects the archive/tar package in stdlib. The Reader.Read function in this package does not set a limit on the maximum size of file headers. This oversight can be exploited by a maliciously crafted archive to cause unbounded memory consumption. As a result, the Read function may allocate excessive amounts of memory, leading to resource exhaustion or panics. To mitigate this issue, the latest versions of stdlib (1.18.7 and 1.19.2) have introduced a limit of 1 MiB on the size of header blocks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability identified as CVE-2022-2879 in the stdlib package's archive/tar module can lead to unbounded memory consumption when reading headers from a tar archive. This can result in resource exhaustion or panics, potentially impacting the affected application or system. To address this issue, it is recommended to update the stdlib package to version 1.18.7 or 1.19.2. Developers should ensure their Go installations or dependencies are using the patched versions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang-1.15 →
FAQ
The vulnerability can be exploited by a maliciously crafted archive to cause unbounded memory consumption. This can lead to resource exhaustion or panics, potentially disrupting the affected application or system.
Yes, all versions of stdlib prior to 1.18.7 and 1.19.2 are vulnerable to this issue. It is recommended to update to the fixed versions to ensure protection against the vulnerability.
There is no known public exploit for this vulnerability at the time of this report. However, it is advisable to apply the fix as soon as possible to prevent any potential exploitation.
Yes, this vulnerability can be exploited remotely if an application accepts and processes maliciously crafted tar archives from untrusted sources.
There is no evidence of active exploitation of this vulnerability reported at the time of this report. However, it is still crucial to apply the fix to mitigate any potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
