CVE-2020-16845: Vulnerability in encoding/binary package
Summary
GO-2021-0225: Certain invalid inputs to ReadUvarint or ReadVarint could cause those functions to read an unlimited number of bytes from the ByteReader argument before returning an error. Affects encoding/binary across 2 version ranges.
< 1.13.15
>= 1.14.0, < 1.14.7
Fixed in 1.13.15 or 1.14.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The encoding/binary package in Go provides functions for reading and writing primitive data types in binary form. It is commonly used for serialization and deserialization tasks. This vulnerability affects the ReadUvarint and ReadVarint functions in the package. These functions could consume an unlimited number of bytes from the input before returning an error when certain invalid inputs are provided. This could lead to processing more input than expected, especially when reading directly from a network. The vulnerability was identified and fixed in versions 1.13.15 and 1.14.7 of the Go programming language.
Vulnerability Detail
The vulnerability in the encoding/binary package arises from the ReadUvarint and ReadVarint functions not properly handling invalid inputs. When such inputs are encountered, these functions could read an unlimited number of bytes from the input before returning an error. This behavior can result in processing more input than expected, which can have various consequences depending on the context. For example, if the caller is reading directly from a network and relies on these functions to consume a small, bounded number of bytes, the excessive consumption of input can lead to resource exhaustion or unexpected behavior. The updated versions of the functions now always return after consuming a bounded number of bytes, specifically 10 bytes, without changing the result being returned. This ensures that the functions detect and return errors without reading excessive input.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.13.151.13.15go get encoding/binary@v1.13.15 -
>= 1.14.0, < 1.14.71.14.7go get encoding/binary@v1.14.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, developers can mitigate the risk by implementing input validation and sanitization measures before using the ReadUvarint and ReadVarint functions. By ensuring that only valid inputs are passed to these functions, the likelihood of triggering the vulnerability can be reduced.
Conclusion
The vulnerability in the encoding/binary package's ReadUvarint and ReadVarint functions could lead to the excessive consumption of input when certain invalid inputs are encountered. This can have various consequences depending on the context, including resource exhaustion and unexpected behavior. To mitigate the risk, it is recommended to update to the fixed versions of the Go programming language and recompile affected applications or libraries. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for encoding/binary →
FAQ
The impact of this vulnerability depends on the specific use case and context. In scenarios where the affected functions are used to read data directly from a network, the excessive consumption of input can lead to resource exhaustion or unexpected behavior. It is important to assess the potential impact in the context of the application or library using the encoding/binary package.
No, not all versions are affected. The vulnerability was introduced in version 1.14.0 and fixed in version 1.14.7. Additionally, it was introduced in version 1.13.0 and fixed in version 1.13.15. It is recommended to update to the fixed versions or any subsequent versions that include the fix.
There is no known exploit publicly disclosed for this vulnerability at the time of writing. However, it is important to promptly apply the fix to mitigate the risk of potential exploitation.
Yes, this vulnerability can be exploited remotely if the affected functions are used to process input directly from a network connection. By sending specially crafted invalid inputs, an attacker could trigger the excessive consumption of input and potentially cause resource exhaustion or unexpected behavior.
There is no evidence of active exploitation of this vulnerability reported at the time of writing. However, it is advisable to apply the fix as soon as possible to minimize the risk of potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for encoding/binary.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
