CVE-2020-15586: Data race and crash in net/http

Background

The stdlib package in the Go ecosystem provides a set of standard libraries for the Go programming language. One of the key packages in the stdlib is net/http, which offers functionality for building HTTP servers and clients. It includes features like request handling, response writing, and routing. However, a vulnerability has been discovered in the net/http package that can lead to a data race and crash in HTTP servers. This vulnerability specifically affects the Handler in HTTP servers where concurrent reading of the request body and writing of a response occurs. The httputil.ReverseProxy Handler is also impacted by this vulnerability.

Vulnerability Detail

The data race and crash vulnerability in net/http can cause HTTP servers to crash when the Handler concurrently reads the request body and writes a response. This can lead to unexpected behavior and denial of service. The vulnerability originates from a race condition in the handling of the request body and response writing. If multiple goroutines access and modify the same data concurrently without proper synchronization, it can result in inconsistent or corrupted state, leading to crashes. The httputil.ReverseProxy Handler is particularly susceptible to this vulnerability.

go get stdlib@vgo1.25.5

Workaround

If updating to the fixed version is not immediately feasible, a possible workaround is to avoid concurrent reading of the request body and writing of the response in the affected Handler. This can be achieved by ensuring that the request body is fully read before writing the response. Here is an example of a workaround code snippet:

func handler(w http.ResponseWriter, r *http.Request) {
    body, err := ioutil.ReadAll(r.Body)
    if err != nil {
        // Handle error
    }
    // Process the request body
    // ...
    // Write the response
    w.Write([]byte("Response"))
}

By reading the entire request body before writing the response, the data race condition can be avoided.

Conclusion

The data race and crash vulnerability in net/http can have serious consequences, including server crashes and denial of service. It is crucial to update the affected version of the Go stdlib package to the fixed version (1.14.5 or later) to mitigate the risk. If immediate updating is not possible, implementing the suggested workaround can help prevent the data race condition. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for stdlib →

FAQ