CVE-2023-24537

Published: Apr 6, 2023Modified: Feb 12, 2025

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.

Affected (2)

Products: Golang: Go

Golang

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Golang Go	Before 1.19.8
Golang Go	From 1.20.0 to 1.20.3

Related CWEs

CWE-190

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (11)

https://go.dev/cl/482078

Source: security@golang.org

Issue TrackingPatch

https://go.dev/issue/59180

Source: security@golang.org

Issue TrackingPatch

https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8

Source: security@golang.org

Mailing ListVendor Advisory

https://pkg.go.dev/vuln/GO-2023-1702

Source: security@golang.org

Vendor Advisory

https://security.gentoo.org/glsa/202311-09

Source: security@golang.org

https://go.dev/cl/482078