CVE-2022-23772: Buffer Overflow
A flaw was found in the big package of the math library in golang. The Rat.SetString could cause an overflow, and if left unhandled, it could lead to excessive memory use. This issue could allow a remote attacker to impact the availability of the system.
Other sources
Golang Go is vulnerable to a denial of service, caused by a buffer overflow in the Rat.SetString function in math/big. By sending a specially-crafted request, an attacker could exploit this vulnerability to consume large amount of RAM and cause the application to crash.
— IBM
Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-23772?
CVE-2022-23772 is a vulnerability in the Rat.SetString function in the math/big package in Go before version 1.16.14 and 1.17.x before version 1.17.7.
What is the severity of CVE-2022-23772?
CVE-2022-23772 has a severity rating of high, with a severity value of 7.
How does CVE-2022-23772 impact the system?
CVE-2022-23772 could lead to excessive memory use and can impact the availability of the system.
How do I fix CVE-2022-23772?
To fix CVE-2022-23772, update your Go installation to version 1.16.14 or 1.17.7, depending on the version you are using.
Where can I find more information about CVE-2022-23772?
You can find more information about CVE-2022-23772 at the following references: [CVE-2022-23772](https://www.cve.org/CVERecord?id=CVE-2022-23772), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-23772), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2053532), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2022:4863).