GO-2022-0289
Misdirected I/O in syscall
At a glance
- Published
- Updated
- CVE
- CVE-2021-44717
- Aliases
- BIT-golang-2021-44717
Description
When a Go program running on a Unix system is out of file descriptors and calls syscall.ForkExec (including indirectly by using the os/exec package), syscall.ForkExec can close file descriptor 0 as it fails. If this happens (or can be provoked) repeatedly, it can result in misdirected I/O such as writing network traffic intended for one connection to a different connection, or content intended for one file to a different one. For users who cannot immediately update to the new release, the bug can be mitigated by raising the per-process file descriptor limit.
Affected packages
| Package | Versions |
|---|---|
| Go · stdlib | introduced 0, fixed 1.16.12, introduced 1.17.0-0, fixed 1.17.5 |
References
- https://go.dev/cl/370576 FIX
- https://go.googlesource.com/go/+/a76511f3a40ea69ee4f5cd86e735e1c8a84f0aa2 FIX
- https://go.dev/issue/50057 REPORT
- https://groups.google.com/g/golang-announce/c/hcmEScgc00k WEB
- https://go.dev/cl/370577 FIX
- https://go.dev/cl/370795 FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |