CVE-2021-38297: Buffer Overflow
A flaw was found in golang. This vulnerability can only be triggered when invoking functions from vulnerable WASM (WebAssembly) Modules. Go can be compiled to WASM. If the product or service doesn't use WASM functions, it is not affected, although it uses golang.
Other sources
Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.
Golang Go is vulnerable to a buffer overflow, caused by improper bounds checking when invoking functions from WASM modules. By passing very large arguments, a remote attacker could overflow a buffer and execute arbitrary code on the system.
— IBM
When invoking functions from WASM modules, built using GOARCH=wasm GOOS=js, passing very large arguments can cause portions of the module to be overwritten with data from the arguments.
If using wasmexec.js to execute WASM modules, users will need to replace their copy (as described in https://golang.org/wiki/WebAssembly#getting-started) after rebuilding any modules.
References:
https://github.com/golang/go/issues/48797 https://groups.google.com/g/golang-announce/c/AEBu9j7yj5A
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/openshift-serverless-clientsto a version that resolves this vulnerability.Fixed in 0:0.26.0-2.el8 - Upgrade
Upgrade
redhat/goto a version that resolves this vulnerability.Fixed in 1.17.2 - Upgrade
Upgrade
redhat/goto a version that resolves this vulnerability.Fixed in 1.16.9 - Configuration
Avoid compiling Go with GOARCH=wasm and GOOS=js (i.e., do not build WebAssembly targets) until using a fixed Go release.
Go build environment GOARCH / GOOS = do not set to wasm / js - Compensating control
If the product or service does not use WASM functions, ensure WASM invocation is disabled or not deployed. If WASM must be used, restrict execution to trusted modules and validate or limit argument sizes passed into WASM functions to mitigate large-argument overflows.
- Operational
If you execute WASM modules with wasm_exec.js, rebuild any affected WASM modules and replace your copy of wasm_exec.js with the updated version after rebuilding.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-38297?
CVE-2021-38297 is a vulnerability in Go before version 1.16.9 and 1.17.x before version 1.17.2 that allows a buffer overflow via large arguments in a function.
How does this vulnerability affect golang?
This vulnerability affects golang when invoking functions from vulnerable WASM (WebAssembly) modules. If the product or service does not use WASM functions, it is not affected.
What is the severity of CVE-2021-38297?
CVE-2021-38297 has a severity rating of critical with a value of 9.
What is the remedy for CVE-2021-38297?
The remedy for CVE-2021-38297 is to update to version 1.16.9 or 1.17.2 of golang.
Where can I find more information about CVE-2021-38297?
You can find more information about CVE-2021-38297 in the provided references: [CVE.org](https://www.cve.org/CVERecord?id=CVE-2021-38297), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-38297), [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2012887), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2022:0434).