CVE-2021-41771: Buffer Overflow
An out of bounds read vulnerability was found in debug/macho of the Go standard library. When using the debug/macho standard library (stdlib) and malformed binaries are parsed using Open or OpenFat, it can cause golang to attempt to read outside of a slice (array) causing a panic when calling ImportedSymbols. An attacker can use this vulnerability to craft a file which causes an application using this library to crash resulting in a denial of service.
Other sources
Golang Go is vulnerable to a denial of service, caused by an out-of-bounds slice situation in the ImportedSymbols function in debug/macho. By using specially-crafted binaries, a remote attacker could exploit this vulnerability to cause a panic, and results in a denial of service condition.
— IBM
ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer aka an out-of-bounds slice situation.
— Microsoft
ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.
Malformed binaries parsed using Open or OpenFat can cause a panic when calling ImportedSymbols, due to an out-of-bounds slice operation.
Reference: https://github.com/golang/go/issues/48990
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/openshift-serverless-clientsto a version that resolves this vulnerability.Fixed in 0:1.1.0-2.el8 - Upgrade
Upgrade
redhat/goto a version that resolves this vulnerability.Fixed in 1.16.10 - Upgrade
Upgrade
redhat/goto a version that resolves this vulnerability.Fixed in 1.17.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.16.2-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.17.8-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.16.10-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-41771.
What is the severity level of CVE-2021-41771?
The severity level of CVE-2021-41771 is high.
Which software versions are affected by CVE-2021-41771?
Software versions before 1.16.10 and 1.17.x before 1.17.3 of Go are affected by CVE-2021-41771.
How can I fix CVE-2021-41771?
To fix CVE-2021-41771, update to version 1.16.10 or later for Go 1.16 and update to version 1.17.3 or later for Go 1.17.
Are there any references for CVE-2021-41771?
Yes, you can find references for CVE-2021-41771 at the following links: [Link 1](https://github.com/golang/go/issues/48990), [Link 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2020726), [Link 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2020728).