Infinite loop in Go programming language - CVE-2024-24788

Vulnerability identifier: #VU89296

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2024-24788

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Go programming language
Oracle Linux
Oracle Solaris
Gentoo Linux
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Server for SAP Applications 12
Anolis OS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Development Tools Module
openSUSE Leap
Ubuntu
Fedora
IBM Concert Software
Consul
Cryostat
Red Hat OpenShift Builds
Run Once Duration Override Operator for Red Hat OpenShift
Ansible Automation Platform
Red Hat OpenShift Dev Spaces
IBM Watson Discovery for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
Kube Descheduler Operator for Red Hat OpenShift
IBM Cloud Pak for Business Automation
IBM Observability with Instana
Operations Dashboard
toolbox
toolbox-tests
toolbox (Red Hat package)
udica
runc
runc (Red Hat package)
slirp4netns
oci-seccomp-bpf-hook
oci-seccomp-bpf-hook (Red Hat package)
containernetworking-plugins
receptor (Red Hat package)
containernetworking-plugins (Red Hat package)
aardvark-dns
netavark
fuse-overlayfs
crun
skopeo
skopeo-tests
skopeo (Red Hat package)
golang-1.21-src (Ubuntu package)
golang-1.21 (Ubuntu package)
golang-1.21-go (Ubuntu package)
golang-1.22-src (Ubuntu package)
golang-1.22-go (Ubuntu package)
golang-1.22 (Ubuntu package)
dev-lang/go
go1.22
go1.22-doc
go1.22-race
go1.22-openssl-debuginfo
go1.22-openssl-race
go1.22-openssl-doc
go1.22-openssl
golang
python3x-urllib3 (Red Hat package)
python-urllib3 (Red Hat package)
buildah
buildah-tests
containers-common
conmon
oath-toolkit (Red Hat package)
container-selinux
crit
criu-libs
criu
criu-devel
python3-criu
python3x-pulpcore (Red Hat package)
python-pulpcore (Red Hat package)
cephadm-ansible (Red Hat package)
python3x-django (Red Hat package)
python-django (Red Hat package)
libslirp
libslirp-devel
automation-controller (Red Hat package)
python3-podman
podman-docker
podman
podman-catatonit
podman-gvproxy
podman-plugins
podman-remote
podman-tests
grafana
grafana (Red Hat package)
ceph (Red Hat package)
cockpit-podman
OpenShift API for Data Protection (OADP)
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Red Hat OpenShift GitOps
Cost Management
Storage Copy Data Management
Storage Protect Server
Storage Protect Plus Server
IBM Cloud Pak System
Red Hat Ceph Storage

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when processing DNS responses. A remote attacker can send a specially crafted DNS response to the application and cause denial of service conditions.

Install updates from vendor's website.

• https://go.dev/issue/66754
• https://go.dev/cl/578375
• https://groups.google.com/g/golang-announce/c/wkkO4P9stm0
• https://pkg.go.dev/vuln/GO-2024-2824