CVE-2021-44717: Infoleak
Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.
Other sources
There's a flaw in golang's syscall.ForkExec() interface. An attacker who manages to first cause a file descriptor exhaustion for the process, then cause syscall.ForkExec() to be called repeatedly, could compromise data integrity and/or confidentiality in a somewhat uncontrolled way in programs linked with and using syscall.ForkExec().
When a Go program running on a Unix system is out of file descriptors and calls syscall.ForkExec (including indirectly by using the os/exec package), syscall.ForkExec can close file descriptor 0 as it fails. If this happens (or can be provoked) repeatedly, it can result in misdirected I/O such as writing network traffic intended for one connection to a different connection, or content intended for one file to a different one.
Reference: https://github.com/golang/go/issues/50057
— Red Hat
Affected Software
Remediation
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-44717?
CVE-2021-44717 is a vulnerability in Go before version 1.16.12 and 1.17.x before 1.17.5 on UNIX that allows write operations to an unintended file or program.
What is the severity of CVE-2021-44717?
The severity of CVE-2021-44717 is medium with a CVSS score of 4.8.
Which software versions are affected by CVE-2021-44717?
Golang Go versions up to 1.16.12 and 1.17.0 to 1.17.5 on UNIX are affected by CVE-2021-44717.
How can an attacker exploit CVE-2021-44717?
An attacker can exploit CVE-2021-44717 by causing file descriptor exhaustion for the process and then repeatedly calling syscall.ForkExec().
Are Opengroup Unix and Debian Debian Linux affected by CVE-2021-44717?
No, Opengroup Unix and Debian Debian Linux are not vulnerable to CVE-2021-44717.
What is the remedy for CVE-2021-44717?
The recommended remedy for CVE-2021-44717 is to update to Go version 1.17.5 if you are using 1.17.x, or to update to Go version 1.16.12 if you are using 1.16.x.