CVE-2022-30635: stdlib - Stack Exhaustion in Decoder.Decode
Summary
CVE-2022-30635: Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures. Affects golang-1.15 versions < 1ed3c127daceaffb9aadc806ba60f0b51b47421b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package is a standard library in the Go programming language. It provides a collection of packages that offer fundamental functionality for Go programs. The package is widely used and forms the backbone of many Go applications. However, it is susceptible to a vulnerability that allows an attacker to cause a panic due to stack exhaustion in the Decoder.Decode function of the encoding/gob package.
Vulnerability Detail
Uncontrolled recursion in the Decoder.Decode function of encoding/gob before Go versions 1.17.12 and 1.18.4 can be exploited by an attacker. By sending a message containing deeply nested structures, the attacker can trigger a panic due to stack exhaustion. This vulnerability poses a high risk as it can lead to denial of service (DoS) attacks and potentially allow an attacker to execute arbitrary code.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the stdlib package to the fixed versions mentioned above to mitigate the risk.
Conclusion
The stdlib package in Go is vulnerable to a stack exhaustion vulnerability in the Decoder.Decode function. This can lead to denial of service (DoS) attacks and potential code execution. It is crucial for developers to update their stdlib package to versions 1.17.12 or 1.18.4 to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang-1.15 →
FAQ
This vulnerability can lead to denial of service (DoS) attacks and potentially allow an attacker to execute arbitrary code.
The vulnerability affects versions of the stdlib package before 1.17.12 and 1.18.4.
No, there is no known workaround. Updating to the fixed versions is the recommended solution.
There are no known public exploits for this vulnerability at the time of writing.
You can find more information about this vulnerability in the National Vulnerability Database (NVD) entry: https://nvd.nist.gov/vuln/detail/CVE-2022-30635.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
