CVE-2022-30632: Stack exhaustion on crafted paths in path/filepath

Background

The stdlib package in Go provides a collection of standard libraries for the Go programming language. The path/filepath package is part of the stdlib and offers functions for manipulating file paths. It is commonly used for tasks such as joining and splitting file paths. However, a vulnerability has been discovered in the Glob function of the path/filepath package.

Vulnerability Detail

Calling Glob on a path that contains a large number of path separators can lead to a panic due to stack exhaustion. This vulnerability allows an attacker to craft a malicious path that triggers the panic, potentially causing a denial-of-service (DoS) condition. The panic occurs when the stack size limit is reached, which can result in the termination of the affected application.

go get stdlib@vgo1.25.5

Workaround

As a workaround, developers can manually limit the number of path separators in the input path before calling the Glob function. This can be achieved by validating and sanitizing user input, ensuring that the path does not contain an excessive number of separators. Here is an example of how to implement this workaround in Go:

import (
    "path/filepath"
    "strings"
)

func globWithSeparatorLimit(path string) ([]string, error) {
    separatorLimit := 100 // Set the maximum number of separators allowed
    separatorCount := strings.Count(path, string(filepath.Separator))
    if separatorCount > separatorLimit {
        return nil, fmt.Errorf("Excessive number of separators in path")
    }
    return filepath.Glob(path)
}

Conclusion

In conclusion, the path/filepath package in the Go stdlib is vulnerable to a stack exhaustion issue when processing crafted paths. This vulnerability can lead to a denial-of-service condition in affected applications. To mitigate the issue, it is recommended to update the stdlib package to the patched versions and implement the provided workaround. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for stdlib →

FAQ