CVE-2022-24675 – This vulnerability is a stack overflow in Go's ... (How to Fix)

Q: What is the severity of CVE-2022-24675?

CVE-2022-24675 has a CVSS score of 7.5 (HIGH). This vulnerability is a stack overflow in Go's encoding/pem package when processing large PEM data. It allows attackers to cause denial of service or potentially execute arbitrary code by crashing the application. Affected are applications using Go versions before 1.17.9 or 1.18.x before 1.18.1 that parse PEM data from untrusted sources.

📋 TL;DR

This vulnerability is a stack overflow in Go's encoding/pem package when processing large PEM data. It allows attackers to cause denial of service or potentially execute arbitrary code by crashing the application. Affected are applications using Go versions before 1.17.9 or 1.18.x before 1.18.1 that parse PEM data from untrusted sources.

💻 Affected Systems

Products:

Go programming language
Applications built with Go that use encoding/pem package

Versions: Go versions before 1.17.9, and 1.18.x before 1.18.1

Operating Systems: All operating systems running affected Go versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only vulnerable when processing PEM data, particularly from untrusted sources. Applications not using encoding/pem package are not affected.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise if the stack overflow can be leveraged for arbitrary code execution.

🟠

Likely Case

Denial of service through application crash when processing malicious PEM data.

🟢

If Mitigated

Limited impact with proper input validation and size limits on PEM data processing.

🌐 Internet-Facing: MEDIUM - Applications accepting PEM data from external sources are vulnerable to DoS attacks.

🏢 Internal Only: LOW - Internal systems processing trusted PEM data have minimal exposure.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending specially crafted large PEM data to vulnerable applications. No public exploit code has been identified.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Go 1.17.9 or Go 1.18.1

Vendor Advisory: https://groups.google.com/g/golang-announce/c/oecdBNLOml8

Restart Required: Yes

Instructions:

1. Identify affected Go installations. 2. Update to Go 1.17.9 or 1.18.1 using official distribution channels. 3. Recompile and redeploy affected applications with the updated Go version. 4. Restart services using the patched Go runtime.

🔧 Temporary Workarounds

Limit PEM input size

all

Implement input validation to restrict the size of PEM data processed by applications

Implement size checking in application code before calling pem.Decode()

Disable PEM processing from untrusted sources

all

Restrict PEM data processing to trusted sources only

Implement source validation for PEM data inputs

🧯 If You Can't Patch

Implement strict input validation to reject PEM data exceeding reasonable size limits
Isolate vulnerable applications behind firewalls and restrict network access to trusted sources only

🔍 How to Verify

Check if Vulnerable:

Check Go version with 'go version' command. If output shows version earlier than 1.17.9 or 1.18.x earlier than 1.18.1, the system is vulnerable if using encoding/pem package.

Check Version:

go version

Verify Fix Applied:

Run 'go version' to confirm version is 1.17.9 or 1.18.1+. Test PEM parsing functionality with large inputs to ensure no crashes.

📡 Detection & Monitoring

Log Indicators:

Application crashes or panics when processing PEM data
Stack overflow errors in application logs
Unusual memory consumption patterns

Network Indicators:

Large PEM data transfers to applications
Repeated connection attempts with PEM payloads

SIEM Query:

source="application.logs" AND ("panic" OR "stack overflow" OR "out of memory") AND "pem"

📊 Metadata

CVE ID: CVE-2022-24675

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-674

Published: April 20, 2022

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-24675, you might also want to check these:

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Fedora by Fedoraproject

Fedora by Fedoraproject

Fedora by Fedoraproject

Go by Golang

Go by Golang

Kubernetes Monitoring Operator by Netapp

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Limit PEM input size

Disable PEM processing from untrusted sources

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities