Skip to content

encoding/gob: stack exhaustion in Decoder.Decode (CVE-2024-34156) [1.23 backport] #69145

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
gopherbot opened this issue Aug 29, 2024 · 2 comments
Closed

encoding/gob: stack exhaustion in Decoder.Decode (CVE-2024-34156) [1.23 backport] #69145

gopherbot opened this issue Aug 29, 2024 · 2 comments
Labels
CherryPickApproved Used during the release process for point releases release-blocker Security
Milestone
Go1.23.1

Comments

@gopherbot
Copy link
Contributor

@rolandshoemaker requested issue #69139 to be considered for backport to the next 1.23 minor release.

@gopherbot please open backport issues for this security fix.
@gopherbot gopherbot added CherryPickCandidate Used during the release process for point releases Security labels Aug 29, 2024
@gopherbot gopherbot mentioned this issue Aug 29, 2024
Closed
@gopherbot gopherbot added this to the Go1.23.1 milestone Aug 29, 2024
@rolandshoemaker rolandshoemaker added release-blocker CherryPickApproved Used during the release process for point releases and removed CherryPickCandidate Used during the release process for point releases labels Aug 29, 2024
@gopherbot
Copy link
Contributor Author

Change https://go.dev/cl/611176 mentions this issue: [release-branch.go1.23] encoding/gob: cover missed cases when checking ignore depth

@gopherbot
Copy link
Contributor Author

Closed by merging CL 611176 (commit fa8ff1a) to release-branch.go1.23.

gopherbot pushed a commit that referenced this issue Sep 5, 2024
@rolandshoemaker @gopherbot
[release-branch.go1.23] encoding/gob: cover missed cases when checkin…
fa8ff1a 
…g ignore depth

This change makes sure that we are properly checking the ignored field
recursion depth in decIgnoreOpFor consistently. This prevents stack
exhaustion when attempting to decode a message that contains an
extremely deeply nested struct which is ignored.

Thanks to Md Sakib Anwar of The Ohio State University ([email protected])
for reporting this issue.

Updates #69139
Fixes #69145
Fixes CVE-2024-34156

Change-Id: Iacce06be95a5892b3064f1c40fcba2e2567862d6
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1440
Reviewed-by: Russ Cox <[email protected]>
Reviewed-by: Damien Neil <[email protected]>
(cherry picked from commit 9f2ea73c5f2a7056b7da5d579a485a7216f4b20a)
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1581
Commit-Queue: Roland Shoemaker <[email protected]>
Reviewed-by: Tatiana Bradley <[email protected]>
Reviewed-on: https://go-review.googlesource.com/c/go/+/611176
Reviewed-by: Dmitri Shuralyov <[email protected]>
Auto-Submit: Dmitri Shuralyov <[email protected]>
Reviewed-by: Michael Pratt <[email protected]>
TryBot-Bypass: Dmitri Shuralyov <[email protected]>
@dmitshur dmitshur changed the title security: fix CVE-2024-34156 [1.23 backport] encoding/gob: stack exhaustion in Decoder.Decode (CVE-2024-34156) [1.23 backport] Sep 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
CherryPickApproved Used during the release process for point releases release-blocker Security
Projects
None yet
Milestone
Go1.23.1
Development

No branches or pull requests
2 participants
@rolandshoemaker @gopherbot