Vulnerability · Published Nov 2, 2022 · Assigned by Go
CVE-2022-41716Unsanitized NUL in environment variables on Windows in syscall and os/exec
Medium 6.3
In plain English
A medium-severity security flaw in os/exec from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-1.19 | 1.19.3-1 | DEBIAN-CVE-2022-41716 |
| Go | stdlib | 1.18.8, 1.19.3 | GO-2022-1095 |
| Ubuntu:22.04:LTS | golang-1.17 | no fix listed | UBUNTU-CVE-2022-41716 |
| Ubuntu:22.04:LTS | golang-1.18 | no fix listed | UBUNTU-CVE-2022-41716 |
| Ubuntu:22.04:LTS | golang-1.20 | no fix listed | UBUNTU-CVE-2022-41716 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | syscall | 0 – before 1.18.81.19.0-0 – before 1.19.3 |
| Go standard library | os/exec | 0 – before 1.18.81.19.0-0 – before 1.19.3 |