CVE-2022-30635

What it actually does

A vulnerability in Go's `encoding/gob` package allows for uncontrolled recursion when decoding a specially crafted message. An attacker can send a gob-encoded payload with deeply nested data structures, causing the `Decoder.Decode` function to recursively call itself without sufficient depth checks. This leads to excessive stack memory consumption, ultimately resulting in a stack exhaustion panic that crashes the application process.

Why it matters to the business

An unauthenticated remote attacker can cause a denial-of-service (DoS) condition in any Go application that decodes untrusted data using the `encoding/gob` package. This can lead to the unavailability of critical services, APIs, and applications, disrupting business operations, impacting user experience, and potentially causing financial loss. The vulnerability is easy to exploit, requiring only the ability to send a malicious message to an exposed service.

How an attack unfolds

An attacker identifies a target service built with a vulnerable version of Go that accepts and processes gob-encoded data from external sources. The attacker crafts a malicious gob payload containing a data structure that is nested to an extreme depth (e.g., a struct that contains a pointer to itself). This payload is then sent to the vulnerable service. When the service's `Decoder.Decode` function attempts to parse the payload, it enters a deep recursion to process the nested structures. Because there is no limit on the recursion depth, the program's call stack is quickly exhausted, triggering a runtime panic that terminates the application process, successfully causing a denial of service.

How to fix it

To remediate this vulnerability, upgrade the Go toolchain and recompile affected applications. The issue is resolved in Go versions 1.17.12 and 1.18.4 and later. Update your project's `go.mod` file to require a patched version of Go and redeploy your applications. If an immediate upgrade is not possible, consider implementing input validation to reject excessively large or complex gob-encoded messages, though this is a less reliable mitigation than upgrading.

How to confirm the fix worked

To validate the fix, verify that all Go applications are compiled with a non-vulnerable version of the Go toolchain (1.17.12+ or 1.18.4+). You can check the Go version used to build a binary with the command `go version <path_to_binary>`. Additionally, you can review `go.mod` files to ensure they specify a patched Go version. For active validation, a test case involving a deeply nested gob structure can be sent to a non-production instance of the application; a patched application should handle the input gracefully by returning an error, while a vulnerable one will crash.

Typical attack path

1. An attacker identifies a network service built with a vulnerable version of Go that deserializes data using the `encoding/gob` package.
2. The attacker crafts a malicious gob-encoded message containing deeply nested data structures.
3. The attacker sends the malicious message to the target service.
4. The service's `Decoder.Decode` function begins processing the message and enters an uncontrolled recursion.
5. The recursion exhausts the process's call stack, triggering a panic.
6. The application process crashes, resulting in a denial of service.

How to detect it

To detect potential exploitation, monitor application and system logs for evidence of Go application crashes. Look for runtime panic messages indicating stack exhaustion, such as 'stack overflow' or 'goroutine stack exceeds limit'. Correlate these crash events with network logs to identify the source of the request that triggered the panic. A sudden increase in application restarts or service unavailability alerts for Go-based services could also indicate exploitation activity.

• fatal error: stack overflow
• runtime: goroutine stack exceeds

What your security team should do

• Immediately identify all Go applications within your environment and determine the Go version they were built with.
• Prioritize upgrading public-facing services or any application that deserializes untrusted data using the `encoding/gob` package.
• Direct development teams to update their Go toolchains to version 1.17.12+ or 1.18.4+ and redeploy all affected applications.
• Monitor affected applications for crash loops or unexpected restarts, which could indicate active exploitation attempts.