CVE-2022-30635: Stack exhaustion when decoding certain messages in encoding/gob
A flaw was found in golang. When calling Decoder, Decode on a message that contains deeply nested structures, a panic can occur due to stack exhaustion and allows an attacker to impact system availability.
Other sources
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.
— Red Hat
Stack exhaustion when decoding certain messages in encoding/gob
— Microsoft
Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/openshift-serverless-clientsto a version that resolves this vulnerability.Fixed in 0:1.3.1-4.el8 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.17-golang-0:1.17.12-1.el7_9 - Upgrade
Upgrade
redhat/git-lfsto a version that resolves this vulnerability.Fixed in 0:2.13.3-3.el8_6 - Upgrade
Upgrade
redhat/grafanato a version that resolves this vulnerability.Fixed in 0:7.5.15-3.el8 - Upgrade
Upgrade
redhat/grafana-pcpto a version that resolves this vulnerability.Fixed in 0:3.2.0-2.el8 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 0:1.17.12-1.el9_0 - Upgrade
Upgrade
redhat/grafanato a version that resolves this vulnerability.Fixed in 0:7.5.15-3.el9 - Upgrade
Upgrade
redhat/grafana-pcpto a version that resolves this vulnerability.Fixed in 0:3.2.0-3.el9 - Upgrade
Upgrade
redhat/git-lfsto a version that resolves this vulnerability.Fixed in 0:3.2.0-1.el9 - Upgrade
Upgrade
redhat/etcdto a version that resolves this vulnerability.Fixed in 0:3.3.23-12.el8 - Upgrade
Upgrade
redhat/kubevirtto a version that resolves this vulnerability.Fixed in 0:4.12.0-1057.el7 - Upgrade
Upgrade
redhat/kubevirtto a version that resolves this vulnerability.Fixed in 0:4.12.0-1057.el8 - Upgrade
Upgrade
debian/golang-1.19to a version that resolves this vulnerability.Fixed in 1.19.8-2 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.18.4 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.17.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.18.5-1 - Upgrade
Upgrade
golangto a version that resolves this vulnerability.Fixed in Go 1.17.12 - Upgrade
Upgrade
golangto a version that resolves this vulnerability.Fixed in Go 1.18.4 - Compensating control
Mitigate availability impact by preventing untrusted clients from sending deeply nested gob messages to encoding/gob Decoder.Decode until Go is upgraded to Go 1.17.12 or Go 1.18.4.
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2022:6345
- RHSA-2022:8634
- RHSA-2023:1042
- RHSA-2022:6040
- RHSA-2022:6042
- RHSA-2022:6152
- RHSA-2022:6348
- RHSA-2022:6346
- RHSA-2022:6347
- RHSA-2022:6370
- RHSA-2023:3642
- RHSA-2022:5866
- RHSA-2022:5775
- RHSA-2022:7129
- RHSA-2022:7519
- RHSA-2022:7648
- RHSA-2023:2758
- RHSA-2023:2802
- RHSA-2022:5799
- RHSA-2022:8057
- RHSA-2022:8250
- RHSA-2023:2357
- RHSA-2022:9047
- RHSA-2022:6283
- RHSA-2023:1275
- RHSA-2023:0407
- RHSA-2023:0408
- RHSA-2023:3742
Frequently Asked Questions
What is CVE-2022-30635?
CVE-2022-30635 is a vulnerability in golang that allows an attacker to cause a panic due to stack exhaustion and impact system availability.
How does CVE-2022-30635 affect software?
CVE-2022-30635 affects versions before Go 1.17.12 and Go 1.18.4, as well as other software packages mentioned in the affected software list.
What is the severity of CVE-2022-30635?
CVE-2022-30635 has a severity level of high (7 out of 10).
How can I fix CVE-2022-30635?
To fix CVE-2022-30635, update to Go 1.17.12 or Go 1.18.4, or apply the appropriate fix for the affected software packages.
Where can I find more information about CVE-2022-30635?
You can find more information about CVE-2022-30635 in the references provided: [CVE website](https://www.cve.org/CVERecord?id=CVE-2022-30635), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-30635), [Go issue tracker](https://go.dev/issue/53615), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2107388), [Red Hat Advisory](https://access.redhat.com/errata/RHSA-2022:6345).