CVE-2022-30634: Vulnerability in stdlib package (Infinite loop in Read)
Summary
CVE-2022-30634: ELSA-2022-17957: ol8addon security update (IMPORTANT). Affects stdlib versions < 1.17.11, 1.18.3. Fixed in 1.17.11, 1.18.3. How to fix ↓
Also tracked for
The same CVE-2022-30634 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The stdlib package is a standard library in the Go programming language. It provides a collection of packages that offer essential functionality for Go programs. The package is widely used and forms the foundation for many Go applications. However, versions before Go 1.17.11 and Go 1.18.3 on Windows are vulnerable to an infinite loop in the Read function of the crypto/rand package. This vulnerability can be exploited by an attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.
Vulnerability Detail
The vulnerability (CVE-2022-30634) in the stdlib package allows an attacker to trigger an infinite loop in the Read function of the crypto/rand package. By passing a buffer larger than 1 << 32 - 1 bytes, the attacker can cause the program to hang indefinitely. This can lead to denial of service (DoS) attacks, as the affected program becomes unresponsive. The vulnerability affects versions before Go 1.17.11 and Go 1.18.3 on Windows.
How To Fix
Minimum fixed version
1.17.11, 1.18.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, updating the stdlib package to the fixed versions (1.17.11 or 1.18.3) is the recommended solution.
Conclusion
The vulnerability in the stdlib package (CVE-2022-30634) can be exploited to cause a denial of service (DoS) by triggering an infinite loop in the Read function of the crypto/rand package. To mitigate this vulnerability, it is crucial to update the stdlib package to version 1.17.11 or 1.18.3. This will ensure that the program is no longer susceptible to the DoS attack. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability allows an attacker to cause a denial of service (DoS) by triggering an infinite loop in the Read function of the crypto/rand package. This can make the affected program unresponsive and lead to service disruption.
Versions before Go 1.17.11 and Go 1.18.3 on Windows are vulnerable to this issue.
No, this vulnerability specifically affects Windows systems running versions before Go 1.17.11 and Go 1.18.3.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
You can find more information about this vulnerability in the National Vulnerability Database (NVD) entry: https://nvd.nist.gov/vuln/detail/cve-2022-30634
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
