CVE-2023-24537 Infinite loop in parsing in go/scanner

2023-04-0615:50:49

www.cve.org

go source code

line directives

integer overflow

9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.5%

JSON

Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.

CNA Affected

[
  {
    "vendor": "Go standard library",
    "product": "go/scanner",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "go/scanner",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.19.8",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.20.0-0",
        "lessThan": "1.20.3",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "Scanner.updateLineInfo"
      },
      {
        "name": "Scanner.Scan"
      }
    ],
    "defaultStatus": "unaffected"
  }
]