CVE-2022-2879: Unbounded memory consumption when reading headers in archive/tar
A flaw was found in the golang package, where Reader.Read does not set a limit on the maximum size of file headers. After fixing, Reader.Read limits the maximum size of header blocks to 1 MiB. This flaw allows a maliciously crafted archive to cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panic.
Other sources
Golang Go is vulnerable to a denial of service, caused by the failure to set a limit on the maximum size of file headers by Reader.Read. By using a specially crafted archive, a remote attacker could exploit this vulnerability to exhaust all available memory resources.
— IBM
Reader.Read did not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. Reader.Read now limits the maximum size of header blocks to 1 MiB.
Ref: https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1
— Red Hat
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
Unbounded memory consumption when reading headers in archive/tar
— Microsoft
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2023:1174
- RHSA-2023:1042
- RHSA-2023:0708
- RHSA-2023:0445
- RHSA-2023:0446
- RHSA-2023:2780
- RHSA-2023:0328
- RHSA-2023:2204
- RHSA-2023:0693
- RHSA-2022:8535
- RHSA-2022:7398
- RHSA-2022:7399
- RHSA-2023:0727
- RHSA-2023:3613
- RHSA-2023:0542
- RHSA-2023:1079
- RHSA-2023:3205
- RHSA-2023:3742
- RHSA-2022:8781
- RHSA-2023:0264
- RHSA-2023:0709
- RHSA-2023:4003
- IBM-7183851
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID for this flaw is CVE-2022-2879.
What is the severity level of CVE-2022-2879?
The severity level of CVE-2022-2879 is high with a score of 7.5.
Which software packages are affected by CVE-2022-2879?
The affected software packages include go, openshift-serverless-clients, go-toolset, osbuild-composer, weldr-client, golang, openshift-clients, buildah, conmon, podman, skopeo, and skupper-cli.
How can I fix the vulnerability in the go package?
You can fix the vulnerability in the go package by updating it to version 1.19.2 or higher.
Is there any additional information about CVE-2022-2879?
Yes, you can find additional information about CVE-2022-2879 in the references provided.