CVE-2022-24921
📋 TL;DR
This vulnerability in Go's regexp.Compile function allows attackers to cause a denial of service via stack exhaustion by providing a deeply nested regular expression. It affects Go applications using regexp.Compile with untrusted input, particularly web servers and network services.
💻 Affected Systems
- Go programming language
- Applications built with Go using regexp package
📦 What is this software?
Go by Golang
Go by Golang
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to stack overflow crash, potentially leading to extended downtime and requiring manual restart of affected applications.
Likely Case
Denial of service affecting specific endpoints or services that process regex patterns from untrusted sources, causing temporary service disruption.
If Mitigated
Minimal impact if input validation limits regex complexity or if applications don't process untrusted regex patterns.
🎯 Exploit Status
Exploitation requires sending a specially crafted regex pattern to trigger stack exhaustion. Proof of concept available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Go 1.16.15 or Go 1.17.8
Vendor Advisory: https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk
Restart Required: Yes
Instructions:
1. Update Go installation to 1.16.15+ or 1.17.8+ using official distribution channels. 2. Recompile all Go applications with the updated version. 3. Restart all Go-based services.
🔧 Temporary Workarounds
Input validation for regex patterns
allValidate and limit complexity of regex patterns from untrusted sources before passing to regexp.Compile
Rate limiting regex processing
allImplement rate limiting on endpoints that accept regex patterns to prevent DoS attacks
🧯 If You Can't Patch
- Implement strict input validation to reject deeply nested regex patterns
- Deploy WAF rules to block patterns with excessive nesting levels
🔍 How to Verify
Check if Vulnerable:
Check Go version with 'go version' command. If version is between 1.0-1.16.14 or 1.17.0-1.17.7, system is vulnerable.Check Version:
go versionVerify Fix Applied:
After updating, verify with 'go version' shows 1.16.15+ or 1.17.8+. Test with known malicious regex patterns to confirm stack exhaustion no longer occurs.📡 Detection & Monitoring
Log Indicators:
- Application crashes with stack overflow errors
- High memory usage spikes during regex processing
- Panic logs containing 'regexp' or 'stack overflow'
Network Indicators:
- Unusually large regex patterns in HTTP POST/PUT requests
- Repeated regex pattern submissions to same endpoint
SIEM Query:
source="application.logs" AND ("panic" OR "stack overflow" OR "regexp")🔗 References
- https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf
- https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk
- https://lists.debian.org/debian-lts-announce/2022/04/msg00017.html
- https://lists.debian.org/debian-lts-announce/2022/04/msg00018.html
- https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html
- https://security.gentoo.org/glsa/202208-02
- https://security.netapp.com/advisory/ntap-20220325-0010/
- https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf
- https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk
- https://lists.debian.org/debian-lts-announce/2022/04/msg00017.html
- https://lists.debian.org/debian-lts-announce/2022/04/msg00018.html
- https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html
- https://security.gentoo.org/glsa/202208-02
- https://security.netapp.com/advisory/ntap-20220325-0010/
