CVE-2021-38297 – This vulnerability allows buffer overflow attac... (How to Fix)

Q: What is the severity of CVE-2021-38297?

CVE-2021-38297 has a CVSS score of 9.8 (CRITICAL). This vulnerability allows buffer overflow attacks when Go programs compile WebAssembly (WASM) modules with GOARCH=wasm and GOOS=js. Attackers can exploit this by passing large arguments to functions, potentially leading to remote code execution. Affected users are those running Go applications that compile or execute WASM modules in vulnerable Go versions.

📋 TL;DR

This vulnerability allows buffer overflow attacks when Go programs compile WebAssembly (WASM) modules with GOARCH=wasm and GOOS=js. Attackers can exploit this by passing large arguments to functions, potentially leading to remote code execution. Affected users are those running Go applications that compile or execute WASM modules in vulnerable Go versions.

💻 Affected Systems

Products:

Go programming language

Versions: Go versions before 1.16.9 and 1.17.x before 1.17.2

Operating Systems: All platforms where Go is used

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects configurations where GOARCH=wasm and GOOS=js are used for WebAssembly compilation.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise, data theft, or ransomware deployment.

🟠

Likely Case

Application crashes (denial of service) or memory corruption leading to unstable behavior.

🟢

If Mitigated

Limited impact if WASM compilation is disabled or proper input validation exists.

🌐 Internet-Facing: HIGH - Web applications using Go-compiled WASM modules could be remotely exploited.

🏢 Internal Only: MEDIUM - Internal tools using vulnerable Go versions with WASM could be exploited by authenticated users.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires crafting malicious WASM modules with large function arguments.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Go 1.16.9 or Go 1.17.2

Vendor Advisory: https://groups.google.com/g/golang-announce/c/AEBu9j7yj5A

Restart Required: Yes

Instructions:

1. Identify Go version with 'go version'. 2. If vulnerable, download patched version from golang.org. 3. Install new version. 4. Recompile all Go applications. 5. Restart services using Go.

🔧 Temporary Workarounds

Disable WASM compilation

all

Prevent compilation or execution of WebAssembly modules in Go applications.

Modify build flags to exclude GOARCH=wasm GOOS=js

🧯 If You Can't Patch

Isolate applications using vulnerable Go versions in restricted network segments.
Implement strict input validation and size limits for WASM module arguments.

🔍 How to Verify

Check if Vulnerable:

Run 'go version' and check if version is before 1.16.9 or 1.17.x before 1.17.2.

Check Version:

go version

Verify Fix Applied:

After patching, run 'go version' to confirm version is 1.16.9+ or 1.17.2+. Test WASM compilation functionality.

📡 Detection & Monitoring

Log Indicators:

Application crashes with memory access violations
Unusual WASM compilation attempts with large payloads

Network Indicators:

Unexpected network traffic to/from Go applications using WASM

SIEM Query:

source="application.logs" AND ("panic" OR "segmentation fault") AND "wasm"

📊 Metadata

CVE ID: CVE-2021-38297

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-120

Published: October 18, 2021

Last Updated: November 21, 2024

🔗 References

https://groups.google.com/forum/#%21forum/golang-announce
https://groups.google.com/g/golang-announce/c/AEBu9j7yj5A Mailing List,Release Notes,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQVUY6Z/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/
https://security.gentoo.org/glsa/202208-02 Third Party Advisory
https://security.netapp.com/advisory/ntap-20211118-0006/ Third Party Advisory
https://groups.google.com/forum/#%21forum/golang-announce
https://groups.google.com/g/golang-announce/c/AEBu9j7yj5A Mailing List,Release Notes,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQVUY6Z/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/
https://security.gentoo.org/glsa/202208-02 Third Party Advisory
https://security.netapp.com/advisory/ntap-20211118-0006/ Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-38297, you might also want to check these: