CVE-2022-30630: stdlib - Uncontrolled recursion in Glob in io/fs
Summary
CVE-2022-30630: Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators. Affects golang-1.19 across 2 version ranges.
< 1.19~rc2-1
< 1ed3c127daceaffb9aadc806ba60f0b51b47421b
Fixed in 1.19~rc2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go provides a collection of standard libraries for the Go programming language. It includes various modules for file system operations, networking, cryptography, and more. The vulnerability, CVE-2022-30630, specifically affects the Glob function in the io/fs module. Glob is used for pattern matching and retrieving file paths. However, prior to versions 1.17.12 and 1.18.4, an uncontrolled recursion issue in Glob can lead to stack exhaustion and cause a panic when processing paths with a large number of path separators.
Vulnerability Detail
The vulnerability arises from the lack of proper recursion control in the Glob function of the io/fs module. An attacker can exploit this flaw by providing a path that contains an excessive number of path separators. When Glob recursively traverses the directory structure to match the provided pattern, the uncontrolled recursion can consume the available stack space, leading to a stack exhaustion and subsequent panic. This can result in a denial-of-service (DoS) condition or potential code execution if the panic is not handled properly.
How To Fix
Minimum fixed version
1.19~rc2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade golang-1.19Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can manually limit the depth of recursion when using the Glob function. By setting a maximum recursion depth or implementing a custom path traversal mechanism, the risk of stack exhaustion can be mitigated. However, it is still strongly advised to update to the fixed versions of Go to ensure comprehensive protection against this vulnerability.
Conclusion
The vulnerability CVE-2022-30630 in the stdlib package's Glob function of the io/fs module can result in stack exhaustion and a panic when processing paths with a large number of path separators. To mitigate this issue, it is crucial to update to Go versions 1.17.12 or 1.18.4, which include the necessary fixes. Developers can also implement custom recursion depth limits as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang-1.19 →
FAQ
The vulnerability can lead to a denial-of-service (DoS) condition or potential code execution if the panic resulting from stack exhaustion is not handled properly. This can disrupt the normal operation of affected applications and potentially allow attackers to execute arbitrary code.
Versions of Go prior to 1.17.12 and 1.18.4 are vulnerable to this issue. It is recommended to update to these fixed versions or later to ensure the security of your Go applications.
No, this vulnerability requires an attacker to provide a specially crafted path containing a large number of path separators. It does not have a remote exploitation vector and requires local or controlled access to the affected system.
Updating to the fixed versions of Go is the primary mitigation for this vulnerability. Additionally, developers can implement custom path traversal mechanisms with recursion depth limits to reduce the risk of stack exhaustion.
As of the last update, there have been no reports of active exploits targeting this specific vulnerability. However, it is always recommended to apply security updates promptly to protect against potential future exploits.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.19.
