CVE-2021-41771 – This vulnerability in Go's debug/macho package ... (How to Fix)

Q: What is the severity of CVE-2021-41771?

CVE-2021-41771 has a CVSS score of 7.5 (HIGH). This vulnerability in Go's debug/macho package allows attackers to read memory beyond allocated buffer boundaries when parsing Mach-O files. It affects applications using Go's debug/macho package to parse untrusted Mach-O files, potentially exposing sensitive memory contents. Systems running Go applications that process Mach-O files from untrusted sources are at risk.

📋 TL;DR

This vulnerability in Go's debug/macho package allows attackers to read memory beyond allocated buffer boundaries when parsing Mach-O files. It affects applications using Go's debug/macho package to parse untrusted Mach-O files, potentially exposing sensitive memory contents. Systems running Go applications that process Mach-O files from untrusted sources are at risk.

💻 Affected Systems

Products:

Go programming language
Applications built with Go that use debug/macho package

Versions: Go 1.0 to 1.16.9, Go 1.17.0 to 1.17.2

Operating Systems: All platforms where Go runs

Default Config Vulnerable: ⚠️ Yes

Notes: Only vulnerable when applications use debug/macho.Open() or debug/macho.OpenFat() on untrusted Mach-O files

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution through memory corruption leading to complete system compromise

🟠

Likely Case

Information disclosure through memory read, potentially exposing sensitive data like credentials or keys

🟢

If Mitigated

Limited impact if applications don't process untrusted Mach-O files or have proper input validation

🌐 Internet-Facing: MEDIUM - Only affects applications that parse Mach-O files from external sources

🏢 Internal Only: LOW - Requires processing of malicious Mach-O files, unlikely in internal-only scenarios

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires delivering a malicious Mach-O file to a vulnerable application

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Go 1.16.10 or Go 1.17.3

Vendor Advisory: https://groups.google.com/g/golang-announce/c/0fM21h43arc

Restart Required: Yes

Instructions:

1. Update Go to version 1.16.10 or 1.17.3+ 2. Recompile all Go applications 3. Restart affected services

🔧 Temporary Workarounds

Disable Mach-O file processing

all

Remove or disable functionality that processes Mach-O files from untrusted sources

Input validation

all

Implement strict validation of Mach-O files before passing to debug/macho functions

🧯 If You Can't Patch

Isolate applications that process Mach-O files in restricted network segments
Implement strict file upload controls and scanning for Mach-O files

🔍 How to Verify

Check if Vulnerable:

Check Go version with 'go version' and verify it's below 1.16.10 or between 1.17.0-1.17.2

Check Version:

go version

Verify Fix Applied:

Verify Go version is 1.16.10+ or 1.17.3+ and applications have been recompiled

📡 Detection & Monitoring

Log Indicators:

Application crashes when processing Mach-O files
Memory access violation errors
Unexpected out-of-memory conditions

Network Indicators:

Unusual Mach-O file uploads to applications
Traffic patterns suggesting file parsing exploitation

SIEM Query:

source="application.log" AND ("panic" OR "segmentation fault" OR "out of bounds") AND "macho"

📊 Metadata

CVE ID: CVE-2021-41771

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-119

Published: November 8, 2021

Last Updated: November 21, 2024

🔗 References

https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf
https://groups.google.com/g/golang-announce/c/0fM21h43arc Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html Mailing List,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html Mailing List,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQVUY6Z/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/
https://security.gentoo.org/glsa/202208-02 Third Party Advisory
https://security.netapp.com/advisory/ntap-20211210-0003/ Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf
https://groups.google.com/g/golang-announce/c/0fM21h43arc Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html Mailing List,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html Mailing List,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQVUY6Z/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/
https://security.gentoo.org/glsa/202208-02 Third Party Advisory
https://security.netapp.com/advisory/ntap-20211210-0003/ Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-41771, you might also want to check these: