CVE-2022-41716
Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.84%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 0.84% probability · 56th percentile
- CISA KEV
- Not listed
- Affected
- golang/go
- Source
- security@golang.org
References
- https://go.dev/cl/446916Patch, Vendor Advisory
- https://go.dev/issue/56284Issue Tracking, Patch, Vendor Advisory
- https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJPatch, Release Notes, Vendor Advisory
- https://pkg.go.dev/vuln/GO-2022-1095Vendor Advisory
- https://go.dev/cl/446916Patch, Vendor Advisory
- https://go.dev/issue/56284Issue Tracking, Patch, Vendor Advisory
- https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJPatch, Release Notes, Vendor Advisory
- https://pkg.go.dev/vuln/GO-2022-1095Vendor Advisory
- https://security.netapp.com/advisory/ntap-20230120-0007/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.