CVE-2022-41716

Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://go.dev/cl/446916	Patch Vendor Advisory
https://go.dev/issue/56284	Issue Tracking Patch Vendor Advisory
https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJ	Patch Release Notes Vendor Advisory
https://pkg.go.dev/vuln/GO-2022-1095	Vendor Advisory
https://go.dev/cl/446916	Patch Vendor Advisory
https://go.dev/issue/56284	Issue Tracking Patch Vendor Advisory
https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJ	Patch Release Notes Vendor Advisory
https://pkg.go.dev/vuln/GO-2022-1095	Vendor Advisory
https://security.netapp.com/advisory/ntap-20230120-0007/

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:golang:go::::::::
	cpe:2.3:a:golang:go::::::::

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-11-02 16:15

Updated : 2024-11-21 07:23

NVD link : CVE-2022-41716

Mitre link : CVE-2022-41716

CVE.ORG link : CVE-2022-41716

JSON object : View

Products Affected

microsoft

windows

golang

go

CWE

NVD-CWE-Other

{"id": "CVE-2022-41716", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2022-11-02T16:15:11.150", "references": [{"url": "https://go.dev/cl/446916", "tags": ["Patch", "Vendor Advisory"], "source": "security@golang.org"}, {"url": "https://go.dev/issue/56284", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "source": "security@golang.org"}, {"url": "https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJ", "tags": ["Patch", "Release Notes", "Vendor Advisory"], "source": "security@golang.org"}, {"url": "https://pkg.go.dev/vuln/GO-2022-1095", "tags": ["Vendor Advisory"], "source": "security@golang.org"}, {"url": "https://go.dev/cl/446916", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://go.dev/issue/56284", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJ", "tags": ["Patch", "Release Notes", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://pkg.go.dev/vuln/GO-2022-1095", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20230120-0007/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string \"A=B\\x00C=D\" sets the variables \"A=B\" and \"C=D\"."}, {"lang": "es", "value": "Debido a valores NUL no sanitizados, los atacantes pueden configurar variables de entorno de forma maliciosa en Windows. En syscall.StartProcess y os/exec.Cmd, los valores de variables de entorno no v\u00e1lidos que contienen valores NUL no se verifican correctamente. Un valor de variable de entorno malicioso puede aprovechar este comportamiento para establecer un valor para una variable de entorno diferente. Por ejemplo, la cadena de variable de entorno \"A=B\\x00C=D\" establece las variables \"A=B\" y \"C=D\"."}], "lastModified": "2024-11-21T07:23:43.507", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38EFB36B-50AE-41B5-A036-EBE041702AF7", "versionEndExcluding": "1.18.8"}, {"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3E7F5D0-6DE2-4D7E-AF0A-04C4BE7F512D", "versionEndExcluding": "1.19.3", "versionStartIncluding": "1.19.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@golang.org"}