CVE-2023-23626: Denial of service when feeding malformed size arguments in go-bitfield
go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the size parameter of NewBitfield and FromBytes functions, an attacker can trigger panics. This happen when the size is a not a multiple of 8 or is negative. There were already a note in the NewBitfield documentation, however known users of this package are subject to this issue. Users are advised to upgrade. Users unable to upgrade should ensure that size is a multiple of 8 before calling NewBitfield or FromBytes.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-23626?
CVE-2023-23626 is a vulnerability in the go-bitfield package for the go language, which can be exploited by an attacker to trigger panics when feeding untrusted user input into certain functions.
What is the severity of CVE-2023-23626?
The severity of CVE-2023-23626 is high, with a severity value of 7.5.
How does CVE-2023-23626 affect the go-bitfield package?
CVE-2023-23626 affects the go-bitfield package up to version 1.1.0 and can be exploited by an attacker to trigger panics.
How can an attacker exploit CVE-2023-23626?
An attacker can exploit CVE-2023-23626 by feeding untrusted user input into the size parameter of certain functions in the go-bitfield package.
Are there any fixes or patches available for CVE-2023-23626?
Yes, fixes for CVE-2023-23626 are available in the commit 5e1d256fe043fc4163343ccca83862c69c52e579 and advisory GHSA-2h6c-j3gf-xp9r.