CVE-2021-38297: Buffer Overflow
A flaw was found in golang. This vulnerability can only be triggered when invoking functions from vulnerable WASM (WebAssembly) Modules. Go can be compiled to WASM. If the product or service doesn't use WASM functions, it is not affected, although it uses golang.
Other sources
Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.
Golang Go is vulnerable to a buffer overflow, caused by improper bounds checking when invoking functions from WASM modules. By passing very large arguments, a remote attacker could overflow a buffer and execute arbitrary code on the system.
— IBM
When invoking functions from WASM modules, built using GOARCH=wasm GOOS=js, passing very large arguments can cause portions of the module to be overwritten with data from the arguments.
If using wasmexec.js to execute WASM modules, users will need to replace their copy (as described in https://golang.org/wiki/WebAssembly#getting-started) after rebuilding any modules.
References:
https://github.com/golang/go/issues/48797 https://groups.google.com/g/golang-announce/c/AEBu9j7yj5A
— Red Hat
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-38297?
CVE-2021-38297 is a vulnerability in Go before version 1.16.9 and 1.17.x before version 1.17.2 that allows a buffer overflow via large arguments in a function.
How does this vulnerability affect golang?
This vulnerability affects golang when invoking functions from vulnerable WASM (WebAssembly) modules. If the product or service does not use WASM functions, it is not affected.
What is the severity of CVE-2021-38297?
CVE-2021-38297 has a severity rating of critical with a value of 9.
What is the remedy for CVE-2021-38297?
The remedy for CVE-2021-38297 is to update to version 1.16.9 or 1.17.2 of golang.
Where can I find more information about CVE-2021-38297?
You can find more information about CVE-2021-38297 in the provided references: [CVE.org](https://www.cve.org/CVERecord?id=CVE-2021-38297), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-38297), [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2012887), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2022:0434).