CVE-2021-38297

Published: Oct 18, 2021Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.

Affected (4)

Products: Golang: Go · Fedoraproject: Fedora

Golang

1 product

Fedoraproject

1 product

Fedora

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Golang Go	Before 1.16.9
Golang Go	From 1.17.0 to 1.17.2

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 34
Fedoraproject Fedora	Version 35

Related CWEs

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (14)

https://groups.google.com/forum/#%21forum/golang-announce

Source: cve@mitre.org

https://groups.google.com/g/golang-announce/c/AEBu9j7yj5A

Source: cve@mitre.org

Mailing ListRelease NotesThird Party Advisory

https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQVUY6Z/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/

Source: cve@mitre.org

https://security.gentoo.org/glsa/202208-02

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20211118-0006/

Source: cve@mitre.org

Third Party Advisory

https://groups.google.com/forum/#%21forum/golang-announce