CVE-2024-24788 Malformed DNS message can cause infinite loop in net
A malformed DNS response causes an infinite loop in Go's net package, leading to denial of service for applications using DNS lookups.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-24788?
CVE-2024-24788 is a medium-severity denial of service vulnerability in Go standard library net, published on 8 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.
Weakness: CWE-835
Which versions are affected by CVE-2024-24788?
2 open source packages ship an affected version, including golang and stdlib.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | From 1.22.0-0 | 1.22.3 |
stdlib Go | From 1.22.0-0 | 1.22.3 |
Linux distribution packages (19)
oci-seccomp-bpf-hook AlmaLinux:9 | All versions | 1.2.10-2.el9 |
runc AlmaLinux:9 | All versions | 4:1.1.13-4.el9 |
go-toolset Red Hat:enterprise_linux:9::appstream | All versions | 0:1.21.10-1.el9_4 |
golang Red Hat:enterprise_linux:9::appstream | All versions | 0:1.21.10-1.el9_4 |
golang-bin Red Hat:enterprise_linux:9::appstream | All versions | 0:1.21.10-1.el9_4 |
golang-docs Red Hat:enterprise_linux:9::appstream | All versions | 0:1.21.10-1.el9_4 |
golang-misc Red Hat:enterprise_linux:9::appstream | All versions | 0:1.21.10-1.el9_4 |
golang-src Red Hat:enterprise_linux:9::appstream | All versions | 0:1.21.10-1.el9_4 |
golang-tests Red Hat:enterprise_linux:9::appstream | All versions | 0:1.21.10-1.el9_4 |
oci-seccomp-bpf-hook Red Hat:enterprise_linux:9::appstream | All versions | 0:1.2.10-2.el9 |
oci-seccomp-bpf-hook-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.2.10-2.el9 |
oci-seccomp-bpf-hook-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:1.2.10-2.el9 |
runc Red Hat:enterprise_linux:9::appstream | All versions | 4:1.1.13-4.el9 |
runc-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 4:1.1.13-4.el9 |
runc-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 4:1.1.13-4.el9 |
oci-seccomp-bpf-hook Rocky Linux:9 | All versions | 0:1.2.10-2.el9 |
runc Rocky Linux:9 | All versions | 4:1.1.13-4.el9 |
forgejo openSUSE:Tumbleweed | All versions | 7.0.3-1.1 |
traefik openSUSE:Tumbleweed | All versions | 3.0.1-1.1 |
How do I fix CVE-2024-24788?
Upgrade golang to 1.22.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-24788 being exploited?
There is no known exploitation of CVE-2024-24788 in the wild and no public exploit code.
Sources
Also known as ALSA-2024:9200, ALSA-2024:9277, AZL-40375, AZL-40436, AZL-40471, AZL-40480 and 16 more.