CVE-2024-9355 Golang-fips: golang fips zeroed buffer
Attackers can force zeroed buffers or false positive hash matches in Go FIPS mode, potentially bypassing cryptographic integrity checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-9355?
CVE-2024-9355 is a medium-severity vulnerability in Red Hat NBDE Tang Server, published on 1 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
Weakness: CWE-457
Which versions are affected by CVE-2024-9355?
3 open source packages ship an affected version, including github.com/golang-fips/openssl.
| Package | Affected | Fixed in |
|---|---|---|
github.com/golang-fips/openssl Go | All versions | None |
github.com/golang-fips/openssl Go | All versions to 2.0.3 | None |
github.com/golang-fips/openssl Go | All versions to 2.0.3 | None |
Linux distribution packages (37)
delve AlmaLinux:8 | All versions | 1.21.2-4.module_el8.10.0+3895+92d465e0 |
go-toolset AlmaLinux:8 | All versions | 1.21.13-1.module_el8.10.0+3895+92d465e0 |
golang AlmaLinux:8 | All versions | 1.21.13-3.module_el8.10.0+3900+bb1e1982 |
golang-bin AlmaLinux:8 | All versions | 1.21.13-3.module_el8.10.0+3900+bb1e1982 |
golang-docs AlmaLinux:8 | All versions | 1.21.13-3.module_el8.10.0+3900+bb1e1982 |
golang-misc AlmaLinux:8 | All versions | 1.21.13-3.module_el8.10.0+3900+bb1e1982 |
golang-src AlmaLinux:8 | All versions | 1.21.13-3.module_el8.10.0+3900+bb1e1982 |
golang-tests AlmaLinux:8 | All versions | 1.21.13-3.module_el8.10.0+3900+bb1e1982 |
grafana-pcp AlmaLinux:8 | All versions | 5.1.1-9.el8_10 |
go-toolset AlmaLinux:9 | All versions | 1.21.13-4.el9_4 |
golang AlmaLinux:9 | All versions | 1.21.13-4.el9_4 |
golang-bin AlmaLinux:9 | All versions | 1.21.13-4.el9_4 |
golang-docs AlmaLinux:9 | All versions | 1.21.13-4.el9_4 |
golang-misc AlmaLinux:9 | All versions | 1.21.13-4.el9_4 |
golang-src AlmaLinux:9 | All versions | 1.21.13-4.el9_4 |
golang-tests AlmaLinux:9 | All versions | 1.21.13-4.el9_4 |
delve Red Hat:enterprise_linux:8::appstream | All versions | 0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6 |
delve-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6 |
delve-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.21.2-4.module+el8.10.0+22329+6cd5c9c6 |
go-toolset Red Hat:enterprise_linux:8::appstream | All versions | 0:1.21.13-1.module+el8.10.0+22329+6cd5c9c6 |
golang Red Hat:enterprise_linux:8::appstream | All versions | 0:1.21.13-3.module+el8.10.0+22345+acdd8d0e |
golang-bin Red Hat:enterprise_linux:8::appstream | All versions | 0:1.21.13-3.module+el8.10.0+22345+acdd8d0e |
golang-docs Red Hat:enterprise_linux:8::appstream | All versions | 0:1.21.13-3.module+el8.10.0+22345+acdd8d0e |
golang-misc Red Hat:enterprise_linux:8::appstream | All versions | 0:1.21.13-3.module+el8.10.0+22345+acdd8d0e |
golang-src Red Hat:enterprise_linux:8::appstream | All versions | 0:1.21.13-3.module+el8.10.0+22345+acdd8d0e |
golang-tests Red Hat:enterprise_linux:8::appstream | All versions | 0:1.21.13-3.module+el8.10.0+22345+acdd8d0e |
grafana-pcp Red Hat:enterprise_linux:8::appstream | All versions | 0:5.1.1-9.el8_10 |
grafana-pcp-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:5.1.1-9.el8_10 |
grafana-pcp-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:5.1.1-9.el8_10 |
go-toolset Red Hat:enterprise_linux:9::appstream | All versions | 0:1.21.13-4.el9_4 |
golang Red Hat:enterprise_linux:9::appstream | All versions | 0:1.21.13-4.el9_4 |
golang-bin Red Hat:enterprise_linux:9::appstream | All versions | 0:1.21.13-4.el9_4 |
golang-docs Red Hat:enterprise_linux:9::appstream | All versions | 0:1.21.13-4.el9_4 |
golang-misc Red Hat:enterprise_linux:9::appstream | All versions | 0:1.21.13-4.el9_4 |
golang-src Red Hat:enterprise_linux:9::appstream | All versions | 0:1.21.13-4.el9_4 |
golang-tests Red Hat:enterprise_linux:9::appstream | All versions | 0:1.21.13-4.el9_4 |
butane Red Hat:rhel_e4s:9.2::appstream | All versions | 0:0.17.0-1.el9_2.1 |
How do I fix CVE-2024-9355?
Apply the vendor's patch.
Is CVE-2024-9355 being exploited?
There is no known exploitation of CVE-2024-9355 in the wild and no public exploit code.
Sources
Also known as ALSA-2024:7502, ALSA-2024:7550, ALSA-2024:8847, AZL-52774, GHSA-3h3x-2hwv-hr52, GO-2024-3167 and 11 more.