CVE-2024-9355
説明
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.
詳細
This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.
軽減策
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVSS (Common Vulnerability Scoring System) のスコアの詳細
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 スコアの内訳
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| ベーススコア | 6.5 | N/A | 6.5 |
| 攻撃ベクトル | Local | N/A | Local |
| 攻撃の複雑さ | High | N/A | High |
| 必要な権限 | Low | N/A | Low |
| ユーザー関与レベル | None | N/A | None |
| 範囲 | Unchanged | N/A | Unchanged |
| 機密性 | High | N/A | High |
| 完全性への影響 | High | N/A | High |
| 可用性への影響 | Low | N/A | Low |
ベクトル
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
cve.org: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
脆弱性の原因 (CWE) の理解
Availability,Integrity,Other
Technical Impact: Other
Initial variables usually contain junk, which can not be trusted for consistency. This can lead to denial of service conditions, or modify control flow in unexpected ways. In some cases, an attacker can "pre-initialize" the variable using previous actions, which might enable code execution. This can cause a race condition if a lock variable check passes when it should not.
Authorization,Other
Technical Impact: Other
Strings that are not initialized are especially dangerous, since many functions expect a null at the end -- and only at the end -- of a string.
謝辞
This issue was discovered by David Benoit (Red Hat).
よくある質問
Not sure what something means? Check out our Security Glossary.
エラータ通知の受信を希望しますか? こちらで登録してください。
