PT-2022-6167 · Go+3 · Go+3

Ryotak

·

Published

2022-10-18

·

Updated

2024-10-30

·

CVE-2022-41716

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:N/I:C/A:N
Name of the Vulnerable Software and Affected Versions Go versions prior to the fixed version
Description The issue is related to unsanitized NUL values in environment variables on Windows. Attackers may exploit this behavior to set arbitrary environment variables. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value, such as the string "A=Bx00C=D", can set the variables "A=B" and "C=D". This can be achieved by exploiting the lack of proper checking for invalid environment variable values.
Recommendations For Go versions prior to the fixed version, update to a version that includes the fix for the unsanitized NUL values in environment variables. As a temporary workaround, consider disabling the use of syscall.StartProcess and os/exec.Cmd until a patch is available. Restrict access to environment variables to minimize the risk of exploitation. Avoid using environment variable values containing NUL values in the affected API endpoints until the issue is resolved.

Fix

Special Elements Injection

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALT-PU-2022-2990
ALT-PU-2022-3013
ALT-PU-2023-1205
ALT-PU-2023-1323
ALT-PU-2023-4785
AZL-79026
BDU:2023-00266
BIT-GOLANG-2022-41716
CVE-2022-41716
GO-2022-1095
MGASA-2022-0444
OESA-2022-2115
OPENSUSE-SU-2022_4054-1
OPENSUSE-SU-2022_4055-1
OPENSUSE-SU-2024:12471-1
OPENSUSE-SU-2024:12472-1
SUSE-SU-2022:4054-1
SUSE-SU-2022:4055-1
SUSE-SU-2022_4054-1
SUSE-SU-2022_4055-1
SUSE-SU-2023:2312-1

Affected Products

Alt Linux
Debian
Go
Suse