Vulnerability · Published Oct 18, 2021 · Assigned by mitre
CVE-2021-38297
Critical 9.8
In plain English
A critical-severity security flaw in the delve package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 11.0% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)11.0%top 4.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | delve | 1.7.2-1.module_el8.6.0+2736+ec10aba8 | ALSA-2022:1819 |
| AlmaLinux:8 | go-toolset | 1.17.7-1.module_el8.6.0+2736+ec10aba8 | ALSA-2022:1819 |
| AlmaLinux:8 | golang | 1.17.7-1.module_el8.6.0+2736+ec10aba8 | ALSA-2022:1819 |
| AlmaLinux:8 | golang-bin | 1.17.7-1.module_el8.6.0+2736+ec10aba8 | ALSA-2022:1819 |
| AlmaLinux:8 | golang-docs | 1.17.7-1.module_el8.6.0+2736+ec10aba8 | ALSA-2022:1819 |
| AlmaLinux:8 | golang-misc | 1.17.7-1.module_el8.6.0+2736+ec10aba8 | ALSA-2022:1819 |
| AlmaLinux:8 | golang-race | 1.17.7-1.module_el8.6.0+2736+ec10aba8 | ALSA-2022:1819 |
| AlmaLinux:8 | golang-src | 1.17.7-1.module_el8.6.0+2736+ec10aba8 | ALSA-2022:1819 |
| AlmaLinux:8 | golang-tests | 1.17.7-1.module_el8.6.0+2736+ec10aba8 | ALSA-2022:1819 |
| Alpine:v3.20 | go | 1.17.2-r0 | ALPINE-CVE-2021-38297 |
| Alpine:v3.21 | go | 1.17.2-r0 | ALPINE-CVE-2021-38297 |
| Alpine:v3.22 | go | 1.17.2-r0 | ALPINE-CVE-2021-38297 |
| Alpine:v3.23 | go | 1.17.2-r0 | ALPINE-CVE-2021-38297 |
| Alpine:v3.24 | go | 1.17.2-r0 | ALPINE-CVE-2021-38297 |
| Go | toolchain | 1.16.9, 1.17.2 | GO-2022-0247 |
| Rocky Linux:8 | delve | 0:1.7.2-1.module+el8.6.0+824+8e984c20 | RLSA-2022:1819 |
| Rocky Linux:8 | go-toolset | 0:1.17.7-1.module+el8.6.0+824+8e984c20 | RLSA-2022:1819 |
| Rocky Linux:8 | golang | 0:1.17.7-1.module+el8.6.0+824+8e984c20 | RLSA-2022:1819 |
Affected products (as reported)
References
- https://groups.google.com/forum/#%21forum/golang-announce
- https://groups.google.com/g/golang-announce/c/AEBu9j7yj5A
- https://security.netapp.com/advisory/ntap-20211118-0006/
- FEDORA-2021-2ef35beebf vendor-advisory
- FEDORA-2021-2b2dd1b5a7 vendor-advisory
- GLSA-202208-02 vendor-advisory
- [debian-lts-announce] 20230419 [SECURITY] [DLA 3395-1] golang-1.11 security update mailing-list