PT-2022-12208 · Go+6 · Go+6

Kamil Trzciński + 1 · Published 2021-12-09 · Updated 2024-06-15 · CVE-2021-44717

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Go versions 1.16.12 and earlier, 1.17.x before 1.17.5

Description The issue allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion. This can result in misdirected I/O, such as writing network traffic intended for one connection to a different connection, or content intended for one file to a different one. The bug can be provoked when a Go program running on a Unix system is out of file descriptors and calls syscall.ForkExec (including indirectly by using the os/exec package).

Recommendations For versions 1.16.12 and earlier, update to version 1.16.12 or later. For versions 1.17.x before 1.17.5, update to version 1.17.5 or later. As a temporary workaround for users who cannot immediately update, consider raising the per-process file descriptor limit to mitigate the bug.

Exploit

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

ALSA-2021:5160

ALT-PU-2021-3504

ALT-PU-2021-3513

ALT-PU-2022-1243

ALT-PU-2022-2873

BIT-GOLANG-2021-44717

CESA-2021_5160

CVE-2021-44717

DLA-2891-1

DLA-2892-1

DLA-3395-1

DLA-3395-2

GO-2022-0289

MGASA-2021-0587

OESA-2022-1661

OPENSUSE-SU-2021:1626-1

OPENSUSE-SU-2021:4169-1

OPENSUSE-SU-2021:4186-1

OPENSUSE-SU-2021_1626-1

OPENSUSE-SU-2021_4169-1

OPENSUSE-SU-2021_4186-1

OPENSUSE-SU-2023:0018-1

OPENSUSE-SU-2023_0018-1

OPENSUSE-SU-2024:11671-1

OPENSUSE-SU-2024:11672-1

OPENSUSE-SU-2024:11947-1

RHSA-2021:5160

RHSA-2021:5176

RHSA-2021_5160

RHSA-2022:0055

RHSA-2022:0557

RHSA-2022:0927

RHSA-2022:1056

RHSA-2022:1361

RHSA-2023:0407

RLSA-2021:5160

SUSE-SU-2021:4169-1

SUSE-SU-2021:4186-1

Affected Products

Alt Linux

Almalinux

Centos

Go

Red Hat

Rocky Linux

Suse

References · 72

• 🔥 https://github.com/alexzorin/cve-2021-34558 · Exploit
• 🔥 https://github.com/gkrishnan724/CVE-2021-38297 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2021:4186-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-44717 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2892-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44717 · Security Note
• https://osv.dev/vulnerability/ALSA-2021:5160 · Vendor Advisory
• https://security.gentoo.org/glsa/202208-02 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3395-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1626-1 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:5160 · Vendor Advisory
• https://groups.google.com/g/golang-announce/c/hcmEScgc00k · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:5160 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44717 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11672-1 · Vendor Advisory