Bug 2107371 (CVE-2022-30630)

Summary: CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
Product: [Other] Security Response Reporter: Anten Skrabec <askrabec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abishop, acui, adam.kaplan, admiller, adudiak, agarcial, agerstmayr, akashem, akoutsou, alakatos, alexander.bulimov, amackenz, amasferr, amurdaca, andrew.jeddeloh, anon.amish, ansmith, aoconnor, aos-network-edge-staff, aos-odin-bot, aos-team-ota, apevec, aputtur, asm, athoscribeiro, bbaude, bbennett, bbuckingham, bcl, bcoca, bcourt, bdettelb, bgilbert, bkundu, blaise, bmontgom, bniver, bodavis, bperkins, bradley.g.smith, bthurber, carl, carmelo.sarta.main, cdaley, chazlett, chousekn, cmarinea, cmeyers, code, comzeradd, container-sig, dagray, davide, davidn, dbenoit, debarshir, deepinde-sig, denis, deparker, dornelas, dperaza, dustymabe, dwalsh, dwd, dwest, dwhatley, dymurray, ebakerupw, eduardo.ramalho, eglynn, ego.cordatus, ehelms, emachado, eparis, epel-packagers-sig, ericedens, esm, extras-orphan, fdeutsch, filbranden, fjansen, flucifre, fpokorny, gblomqui, gchamoul, gmeno, go-sig, gparvin, grafana-maint, gscrivan, hhorak, ibolton, iboverma, i, ijolliff, infra-sig, jacding, jaharrin, jbrooks, jburrell, jcajka, jcammara, jchaloup, jchui, jeder, jhadvig, jhardy, jhrozek, jitsingh, jjelen, jjoyce, jlieskov, jligon, jmatthew, jmencak, jmontleo, jnovy, jobarker, jonathan, jorton, jpadman, jramanat, jsherril, jvymazal, jwboyer, jwendell, jwon, kgiusti, kolyshkin, ktokunaga.mail, kvanderr, kwalker, lacypret, lball, lbragsta, lemenkov, lhh, lkiesow, lkundrak, lmadsen, lmeyer, lsm5, lzap, mabashia, maciek.borzecki, mah.darade, marcandre.lureau, mark.e.fuller, mattia.verga, matzew, maxwell, mbenjamin, mboddu, mburns, mcressma, me, me, mfojtik, mgarciac, mgoodwin, mhackett, mheon, mhulan, miabbott, michel, miminar, mkudlej, mmagr, mmccune, mnewsome, mrunge, mrussell, mskalicky, mwringe, nathans, ngompa13, njean, nmoumoul, nobody, notting, nparekh, nstielau, n.yaghoobi.s, obudai, obulatov, ocp-storage-bot, ocs-bugs, o.lemasle, openshift-release-oversight, orabin, osapryki, osbuilders, oskutka, pahickey, pakotvan, patrick, paul, paul.wouters, pcreech, pegoncal, pehunt, philipp, pjindal, pknezevi, pkubat, ploffay, podvody, pthomas, quantum.analyst, rakesh.pandit, rcernich, rchan, redhat, relrod, rh.container.bot, rhcos-sst, rhcos-triage, rhos-maint, rhuss, robinlee.sysu, rominf, rpetrell, rphillips, rsroka, ryncsn, sanchezl, sanne.raymaekers, santiago, saroy, scorneli, sdoran, sejug, sgott, sipoyare, skunkerk, slaznick, slucidi, smcdonal, sostapov, spandura, sponnaga, spower, spresti, sseago, ssteinbe, stcannon, strigazi, surbania, team-winc-bot, tfister, tgunders, thoiland, thrcka, TicoTimo, tjochec, tkorbar, tkuratom, tosykora, travier, tsedovic, tstellar, tsweeney, ttomecek, twalsh, uhhadd, umohnani, user-cont-team+packit-fas, vereddy, vkumar, vrothber, walters, wenshen, whayutin, xiyuan, xxia, yanqiyu01, yselkowi, ytale, zdohnal, zebob.m, zfridric
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: golang 1.18.4, golang 1.17.12 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to impact availability.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2023-05-16 23:46:17 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2115934, 2107372, 2109914, 2109915, 2109916, 2109917, 2110276, 2110355, 2111001, 2111496, 2111746, 2111747, 2111752, 2111753, 2111758, 2111759, 2111760, 2111765, 2111766, 2111767, 2111772, 2111773, 2111774, 2111775, 2111782, 2111783, 2111786, 2111789, 2111790, 2111791, 2111792, 2111796, 2111797, 2111798, 2111803, 2111805, 2111806, 2111807, 2111808, 2111816, 2111821, 2111822, 2111823, 2111826, 2111827, 2111828, 2111829, 2111830, 2111831, 2111833, 2112009, 2112010, 2115932, 2115933, 2115935, 2115936, 2115937, 2115938, 2115939, 2115940, 2115941, 2115942, 2115943, 2115944, 2115945, 2115946, 2115947, 2115948, 2115949, 2115950, 2115951, 2115952, 2123509, 2123510, 2123514, 2123748, 2123750, 2123754, 2134423, 2134424, 2168805    
Bug Blocks: 2106609    

Description Anten Skrabec 2022-07-14 20:30:29 UTC 
Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion.
Comment 1 Anten Skrabec 2022-07-14 20:30:44 UTC 
Created golang tracking bugs for this issue:

Affects: fedora-all [bug 2107372]
Comment 2 Vitaly 2022-07-15 06:56:16 UTC 
Why did you add me and all these people as CCs to this ticket?
Comment 5 Anten Skrabec 2022-07-18 19:30:13 UTC 
In reply to comment #2:
> Why did you add me and all these people as CCs to this ticket?

No idea why that happened. This bug was created through tooling, I'll report a bug.
Comment 11 Avinash Hanwate 2022-07-25 09:58:29 UTC 
Created golang tracking bugs for this issue:

Affects: epel-all [bug 2110355]
Comment 33 errata-xmlrpc 2022-08-01 12:03:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:5775 https://access.redhat.com/errata/RHSA-2022:5775
Comment 34 errata-xmlrpc 2022-08-01 16:03:56 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:5799 https://access.redhat.com/errata/RHSA-2022:5799
Comment 35 errata-xmlrpc 2022-08-02 09:53:24 UTC 
This issue has been addressed in the following products:

  Red Hat Developer Tools

Via RHSA-2022:5866 https://access.redhat.com/errata/RHSA-2022:5866
Comment 37 errata-xmlrpc 2022-08-10 11:37:18 UTC 
This issue has been addressed in the following products:

  Openshift Serverless 1 on RHEL 8

Via RHSA-2022:6042 https://access.redhat.com/errata/RHSA-2022:6042
Comment 38 errata-xmlrpc 2022-08-10 13:16:04 UTC 
This issue has been addressed in the following products:

  Openshift Serveless 1.24

Via RHSA-2022:6040 https://access.redhat.com/errata/RHSA-2022:6040
Comment 40 errata-xmlrpc 2022-08-18 15:10:26 UTC 
This issue has been addressed in the following products:

  Application Interconnect 1 for RHEL 8

Via RHSA-2022:6113 https://access.redhat.com/errata/RHSA-2022:6113
Comment 41 errata-xmlrpc 2022-08-25 11:21:07 UTC 
This issue has been addressed in the following products:

  Node Maintenance Operator 4.11 for RHEL 8

Via RHSA-2022:6188 https://access.redhat.com/errata/RHSA-2022:6188
Comment 42 errata-xmlrpc 2022-08-31 18:49:21 UTC 
This issue has been addressed in the following products:

  OSSM-2.2-RHEL-8

Via RHSA-2022:6283 https://access.redhat.com/errata/RHSA-2022:6283
Comment 43 errata-xmlrpc 2022-09-01 05:41:11 UTC 
This issue has been addressed in the following products:

  OSSO-1.1-RHEL-8

Via RHSA-2022:6152 https://access.redhat.com/errata/RHSA-2022:6152
Comment 44 errata-xmlrpc 2022-09-06 12:58:34 UTC 
This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8

Via RHSA-2022:6347 https://access.redhat.com/errata/RHSA-2022:6347
Comment 45 errata-xmlrpc 2022-09-06 13:02:45 UTC 
This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8

Via RHSA-2022:6346 https://access.redhat.com/errata/RHSA-2022:6346
Comment 46 errata-xmlrpc 2022-09-06 13:42:51 UTC 
This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8

Via RHSA-2022:6348 https://access.redhat.com/errata/RHSA-2022:6348
Comment 47 errata-xmlrpc 2022-09-06 14:33:40 UTC 
This issue has been addressed in the following products:

  multicluster engine for Kubernetes 2.1 for RHEL 8

Via RHSA-2022:6345 https://access.redhat.com/errata/RHSA-2022:6345
Comment 48 errata-xmlrpc 2022-09-06 22:29:43 UTC 
This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8

Via RHSA-2022:6370 https://access.redhat.com/errata/RHSA-2022:6370
Comment 49 errata-xmlrpc 2022-09-13 02:10:11 UTC 
This issue has been addressed in the following products:

  OADP-1.0-RHEL-8

Via RHSA-2022:6430 https://access.redhat.com/errata/RHSA-2022:6430
Comment 54 errata-xmlrpc 2022-10-25 09:29:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7129 https://access.redhat.com/errata/RHSA-2022:7129
Comment 58 errata-xmlrpc 2022-11-08 09:25:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7519 https://access.redhat.com/errata/RHSA-2022:7519
Comment 59 errata-xmlrpc 2022-11-08 09:28:40 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7529 https://access.redhat.com/errata/RHSA-2022:7529
Comment 60 errata-xmlrpc 2022-11-08 10:00:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7648 https://access.redhat.com/errata/RHSA-2022:7648
Comment 61 errata-xmlrpc 2022-11-15 10:06:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:8057 https://access.redhat.com/errata/RHSA-2022:8057
Comment 62 errata-xmlrpc 2022-11-15 10:15:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:8098 https://access.redhat.com/errata/RHSA-2022:8098
Comment 63 errata-xmlrpc 2022-11-15 10:43:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:8250 https://access.redhat.com/errata/RHSA-2022:8250
Comment 68 errata-xmlrpc 2022-12-15 01:57:43 UTC 
This issue has been addressed in the following products:

  Red Hat Migration Toolkit for Containers 1.7

Via RHSA-2022:9047 https://access.redhat.com/errata/RHSA-2022:9047
Comment 83 errata-xmlrpc 2023-01-24 12:49:11 UTC 
This issue has been addressed in the following products:

  RHEL-8-CNV-4.12
  RHEL-7-CNV-4.12

Via RHSA-2023:0407 https://access.redhat.com/errata/RHSA-2023:0407
Comment 84 errata-xmlrpc 2023-01-24 13:34:58 UTC 
This issue has been addressed in the following products:

  RHEL-8-CNV-4.12

Via RHSA-2023:0408 https://access.redhat.com/errata/RHSA-2023:0408
Comment 95 errata-xmlrpc 2023-03-06 18:39:19 UTC 
This issue has been addressed in the following products:

  OpenShift Custom Metrics Autoscaler 2

Via RHSA-2023:1042 https://access.redhat.com/errata/RHSA-2023:1042
Comment 97 errata-xmlrpc 2023-03-15 19:55:19 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.1
  Red Hat OpenStack Platform 16.2

Via RHSA-2023:1275 https://access.redhat.com/errata/RHSA-2023:1275
Comment 98 errata-xmlrpc 2023-03-30 00:43:19 UTC 
This issue has been addressed in the following products:

  STF-1.5-RHEL-8

Via RHSA-2023:1529 https://access.redhat.com/errata/RHSA-2023:1529
Comment 99 errata-xmlrpc 2023-05-09 07:34:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2357 https://access.redhat.com/errata/RHSA-2023:2357
Comment 103 errata-xmlrpc 2023-05-16 08:08:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:2758 https://access.redhat.com/errata/RHSA-2023:2758
Comment 104 errata-xmlrpc 2023-05-16 08:14:38 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:2802 https://access.redhat.com/errata/RHSA-2023:2802
Comment 106 Product Security DevOps Team 2023-05-16 23:46:03 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-30630
Comment 107 errata-xmlrpc 2023-06-15 16:00:15 UTC 
This issue has been addressed in the following products:

  Red Hat Ceph Storage 6.1

Via RHSA-2023:3642 https://access.redhat.com/errata/RHSA-2023:3642