CVE-2022-30634 Indefinite hang with large buffers on Windows in crypto/rand

2022-07-1519:36:19

www.cve.org

cve-2022-30634

indefinite hang

windows

crypto/rand

large buffer

AI Score

7.8

Confidence

High

EPSS

0.002

Percentile

51.6%

JSON

Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.

CNA Affected

[
  {
    "vendor": "Go standard library",
    "product": "crypto/rand",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "crypto/rand",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.17.11",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.18.0-0",
        "lessThan": "1.18.3",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "platforms": [
      "windows"
    ],
    "programRoutines": [
      {
        "name": "Read"
      }
    ],
    "defaultStatus": "unaffected"
  }
]