Upstream information

CVE-2024-1394 at MITRE

Description

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function uses named return parameters to free pkey and ctx if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey and ctx will be nil inside the deferred function that should free them.

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having important severity.

No SUSE Bugzilla entries cross referenced.

No SUSE Security Announcements cross referenced.

List of released packages

Product(s) Fixed package version(s) References
SUSE Liberty Linux 8
  • delve >= 1.20.2-1.module+el8.9.0+18926+5193682d
  • go-toolset >= 1.20.12-1.module+el8.9.0+21033+5795bdf6
  • golang >= 1.20.12-3.module+el8.9.0+21528+703c3aa2
  • golang-bin >= 1.20.12-3.module+el8.9.0+21528+703c3aa2
  • golang-docs >= 1.20.12-3.module+el8.9.0+21528+703c3aa2
  • golang-misc >= 1.20.12-3.module+el8.9.0+21528+703c3aa2
  • golang-src >= 1.20.12-3.module+el8.9.0+21528+703c3aa2
  • golang-tests >= 1.20.12-3.module+el8.9.0+21528+703c3aa2
  • grafana >= 9.2.10-16.el8_10
  • grafana-pcp >= 5.1.1-2.el8_9
  • grafana-selinux >= 9.2.10-16.el8_10
 Patchnames:
RHSA-2024:1472
RHSA-2024:1644
RHSA-2024:1646
RHSA-2024:3265
SUSE Liberty Linux 9
  • go-toolset >= 1.21.9-2.el9_4
  • golang >= 1.21.9-2.el9_4
  • golang-bin >= 1.21.9-2.el9_4
  • golang-docs >= 1.21.9-2.el9_4
  • golang-misc >= 1.21.9-2.el9_4
  • golang-src >= 1.21.9-2.el9_4
  • golang-tests >= 1.21.9-2.el9_4
  • grafana >= 9.2.10-16.el9_4
  • grafana-pcp >= 5.1.1-2.el9_4
  • grafana-selinux >= 9.2.10-16.el9_4
 Patchnames:
RHSA-2024:1462
RHSA-2024:1501
RHSA-2024:1502
RHSA-2024:2562
RHSA-2024:2568
RHSA-2024:2569

SUSE Timeline for this CVE

CVE page created: Wed Mar 20 19:00:16 2024
CVE page last modified: Sun Jun 16 11:53:37 2024