CVE-2022-30630: Stack exhaustion in Glob on certain paths in io/fs

Background

The stdlib package in Go provides a collection of standard libraries for the Go programming language. One of the packages in the stdlib is io/fs, which offers a set of interfaces and functions for working with the file system. The Glob function in io/fs is used to match file paths against a pattern containing wildcards. This allows users to easily find files that match a specific pattern. However, a vulnerability has been discovered in the Glob function that can lead to a stack exhaustion when called on a path with a large number of path separators.

Vulnerability Detail

The vulnerability (CVE-2022-30630) arises when the Glob function is invoked on a path that contains an excessive number of path separators. This can cause a panic due to stack exhaustion, leading to a denial of service (DoS) condition. An attacker could potentially exploit this vulnerability by providing a specially crafted path to the Glob function, causing the Go program to crash. The impact of this vulnerability is limited to applications that use the affected version of the stdlib package and invoke the Glob function on user-supplied paths. It is important to note that this vulnerability does not allow arbitrary code execution or unauthorized access to sensitive information.

go get stdlib@vgo1.25.5

Workaround

If updating the stdlib package is not immediately feasible, a temporary workaround can be implemented by avoiding the use of the Glob function on user-supplied paths. Instead, developers can manually validate and sanitize user input to ensure it does not contain an excessive number of path separators before invoking the Glob function. Here is an example of how this can be done in Go:

import (
	"io/fs"
	"strings"
)

func safeGlob(path string) ([]string, error) {
	if strings.Count(path, string(fs.Separator)) > 100 {
		return nil, fmt.Errorf("Path contains too many separators")
	}
	return fs.Glob(path)
}

Conclusion

In conclusion, the stdlib package in Go is vulnerable to a stack exhaustion issue in the Glob function when invoked on paths with a large number of path separators. This can lead to a denial of service (DoS) condition. To mitigate this vulnerability, it is crucial to update the stdlib package to the fixed versions or implement the provided workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for stdlib →

FAQ