CVE-2022-24921: Input Validation
A stack overflow flaw was found in Golang's regexp module, which can crash the runtime if the application using regexp accepts very long or arbitrarily long regexps from untrusted sources that have sufficient nesting depths. To exploit this vulnerability, an attacker would need to send large regexps with deep nesting to the application. Triggering this flaw leads to a crash of the runtime, which causes a denial of service.
Other sources
Golang Go is vulnerable to a denial of service, caused by improper input validation. By using a specially-crafted deeply nested expression, a remote attacker could exploit this vulnerability to cause a goroutine stack exhaustion, and results in a denial of service condition.
— IBM
regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/openshift-serverless-clientsto a version that resolves this vulnerability.Fixed in 0:1.3.1-4.el8 - Upgrade
Upgrade
redhat/servicemeshto a version that resolves this vulnerability.Fixed in 0:2.1.5-1.el8 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.17-golang-0:1.17.10-1.el7_9 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 0:1.17.12-1.el9_0 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 0:1.17.12-1.el9_0 - Upgrade
Upgrade
redhat/cri-oto a version that resolves this vulnerability.Fixed in 0:1.23.3-11.rhaos4.10.gitddf4b1a.1.el7 - Upgrade
Upgrade
redhat/cri-toolsto a version that resolves this vulnerability.Fixed in 0:1.23.0-1.1.el8 - Upgrade
Upgrade
redhat/butaneto a version that resolves this vulnerability.Fixed in 0:0.15.0-1.rhaos4.11.el8 - Upgrade
Upgrade
redhat/ignitionto a version that resolves this vulnerability.Fixed in 0:2.14.0-3.rhaos4.11.el8 - Upgrade
Upgrade
redhat/openshift-clientsto a version that resolves this vulnerability.Fixed in 0:4.11.0-202207291716.p0.g7075089.assembly.stream.el8 - Upgrade
Upgrade
redhat/kubevirtto a version that resolves this vulnerability.Fixed in 0:4.12.0-1057.el7 - Upgrade
Upgrade
redhat/kubevirtto a version that resolves this vulnerability.Fixed in 0:4.12.0-1057.el8 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.16.15 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.17.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.16.2-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.17.8-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.16.15-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-24921?
CVE-2022-24921 is a vulnerability found in Golang's regexp module that can cause a stack overflow leading to a runtime crash.
How does CVE-2022-24921 impact the affected software?
CVE-2022-24921 can crash the runtime if the application using regexp accepts very long or arbitrarily long regexps, potentially leading to denial of service.
Which versions of Golang are affected by CVE-2022-24921?
Golang versions before 1.16.15 and 1.17.x before 1.17.8 are affected by CVE-2022-24921.
What is the severity of CVE-2022-24921?
CVE-2022-24921 has a severity score of 7.5 (high).
How can I fix CVE-2022-24921?
To fix CVE-2022-24921, upgrade to Golang version 1.16.15 or 1.17.8, depending on the version you are using.