CVE-2024-7652

What it actually does

Type confusion in ECMA-262 Async Generators resulting in memory corruption and an exploitable crash.

Why it matters to the business

Applications depending on the affected Go library may experience crashes or remote code execution, disrupting services and requiring urgent updates across the ecosystem with many downstream dependents.

How an attack unfolds

An attacker supplies crafted input that triggers the type confusion during async generator operations, leading to memory corruption that can be leveraged for a crash or further exploitation.

How to fix it

Upgrade github.com/flynn/noise to version 1.0.0.

How to confirm the fix worked

Verify the installed version of the noise library matches or exceeds the fixed release and test for absence of the type confusion behavior.

Typical attack path

1. Locate instances of the vulnerable noise library version
2. Send malicious input designed to hit async generator handling
3. Trigger type confusion to induce memory corruption
4. Escalate the corruption into a crash or code execution

How to detect it

Review application logs and crash reports for memory corruption indicators tied to async generator processing.

What your security team should do

• Immediately upgrade all instances to the fixed version 1.0.0
• Inventory Go dependencies to identify exposure
• Monitor application stability post-update