CVE-2024-24790

Misinterpretation of Input (CWE-115)

Published: Jun 5, 2024 / Updated: 5mo ago

010
CVSS 9.8EPSS 0.05%Critical
CVE info copied to clipboard

Summary

The various IP address classification methods (IsPrivate, IsLoopback, etc.) in Go's net package did not work correctly for IPv4-mapped IPv6 addresses, returning false for addresses that should have returned true in their IPv4 form.

Impact

This vulnerability could allow an attacker to bypass network access controls or authorization checks that rely on correct IP address classification. Depending on how applications use these methods, it may lead to unauthorized access, information disclosure, or other security issues. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical), with high impacts on confidentiality, integrity, and availability.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

Patches are available. Go versions 1.19.2 and 1.18.9 have been released to fix this issue. Applications using affected versions should upgrade. Patch details have been provided by multiple sources including Red Hat, go.dev, and Oracle.

Mitigation

As a workaround until patched versions can be deployed, implement custom IP address classification logic instead of using the vulnerable net package methods. Filter both IPv4 and IPv4-mapped IPv6 addresses. It's crucial to upgrade to the patched versions (Go 1.19.2 or 1.18.9) as soon as possible.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

First Article

Feedly found the first article mentioning CVE-2024-24790. See article

Jun 4, 2024 at 5:16 PM / Recent Commits to go:master
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Jun 4, 2024 at 5:16 PM
CVE Assignment

NVD published the first details for CVE-2024-24790

Jun 5, 2024 at 4:15 PM
Trending

This CVE started to trend in security discussions

Jun 5, 2024 at 6:04 PM
EPSS

EPSS Score was set to: 0.05% (Percentile: 15.2%)

Jun 6, 2024 at 11:04 AM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (200209)

Jun 7, 2024 at 7:15 PM
Trending

This CVE stopped trending in security discussions

Jun 7, 2024 at 7:36 PM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (756412)

Jun 8, 2024 at 1:15 AM
Vendor Advisory

RedHat CVE advisory released a security advisory (CVE-2024-24790).

Jun 17, 2024 at 10:55 PM
Static CVE Timeline Graph

Affected Systems

Golang/go
+null more

Patches

Oracle
+null more

Vendor Advisory

Oracle Solaris Third Party Bulletin - July 2024
Starting January 20, 2015, Third Party Bulletins are released on the same day when Oracle Critical Patch Updates are released. Oracle Solaris Third Party Bulletin Risk Matrix (Revision 3: Published on 2024-09-24)

References

Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.4
The vulnerability exists due to a boundary error within the BZ2_decompress() function in decompress.c. A remote attacker can create a specially crafted archive, trick the victim into opening it using the affected library, trigger out-of-bounds write and execute arbitrary code on the target system. The vulnerability allows a remote attacker to execute arbitrary code on the target system.

News

[ALSA-2024:9115] Moderate: grafana security update
AlmaLinux Security Advisory: ALSA-2024:9115 Release Date: 2024-11-12 Update Date: 2024-11-19 Severity: Moderate Advisory Type: Security CVEs : CVE-2024-24788, CVE-2024-24789, CVE-2024-24790, CVE-2024-24791, CVE-2024-6104 Description Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * golang: net:
oracle_linux ELSA-2024-9115: ELSA-2024-9115: grafana security update (MODERATE)
Testing Last Updated: 11/19/2024 CVEs: CVE-2024-24788 , CVE-2024-24789 , CVE-2024-6104 , CVE-2024-24791 , CVE-2024-24790
PAN-SA-2024-0012 Informational Bulletin: OSS CVEs fixed in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS. While it was not determined that these CVEs have any significant impact on PAN-OS, they have been fixed out of an abundance of caution.
ubuntu_linux USN-7109-1: Ubuntu 16.04 LTS / Ubuntu 18.04 LTS / Ubuntu 20.04 LTS / Ubuntu 22.04 LTS : Go vulnerabilities (USN-7109-1)
Development Last Updated: 11/14/2024 CVEs: CVE-2023-29403 , CVE-2023-29402 , CVE-2023-39319 , CVE-2023-29405 , CVE-2024-24784 , CVE-2024-24789 , CVE-2023-45290 , CVE-2024-34158 , CVE-2023-29404 , CVE-2023-24536 , CVE-2023-45288 , CVE-2024-34156 , CVE-2024-24790 , CVE-2024-24785 , CVE-2023-39318 , CVE-2022-41723 , CVE-2024-34155 , CVE-2023-39325 , CVE-2022-41725 , CVE-2023-24531 , CVE-2022-41724 , CVE-2024-24783 , CVE-2024-24791 , CVE-2023-39323 , CVE-2023-29406
Red Hat Security Advisory 2024-9583-03
The following advisory data is extracted from:https://security.access.redhat.com/data/csaf/v2/advi
See 269 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI