Google Go Regular Expression resource consumption

Summaryinfo

A vulnerability described as problematic has been identified in Google Go. This impacts an unknown function of the component Regular Expression Handler. The manipulation results in resource consumption. This vulnerability was named CVE-2022-41715. The attack may be performed from remote. There is no available exploit. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability classified as problematic has been found in Google Go (Programming Language Software) (unknown version). Affected is an unknown code block of the component Regular Expression Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. CVE summarizes:

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.

The weakness was presented 10/15/2022. The advisory is available at go.dev. This vulnerability is traded as CVE-2022-41715 since 09/28/2022. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 211529 (Oracle Linux 9 : grafana (ELSA-2024-9115)), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at Tenable (211529). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Programming Language Software

Vendor

• Google

Name

• Go

License

• open-source

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion