Vulnerability · Published Jul 15, 2022 · Assigned by Go
CVE-2022-30634Indefinite hang with large buffers on Windows in crypto/rand
High 7.5
In plain English
A high-severity security flaw in crypto/rand from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.3%top 16.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | stdlib | 1.17.11, 1.18.3 | GO-2022-0477 |
| Ubuntu:22.04:LTS | golang-1.17 | no fix listed | UBUNTU-CVE-2022-30634 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | crypto/rand | 0 – before 1.17.111.18.0-0 – before 1.18.3 |