Bug 2262921 (CVE-2024-1394)

Summary:	CVE-2024-1394 golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abishop, adudiak, amctagga, anjoseph, ansmith, apevec, askrabec, bodavis, brking, chazlett, crizzo, danken, dbenoit, dfreiber, dhanak, dholler, dkenigsb, dperaza, drosa, drow, dshah, dsimansk, eglynn, emachado, epacific, fdeutsch, fgustavs, ganandan, gkamathe, haoli, hhorak, hkataria, jaharrin, jajackso, jburati, jburrell, jcammara, jchui, jeder, jhardy, jjoyce, jmitchel, jneedle, jobarker, joelsmith, jorton, jprabhak, jschluet, kegrant, kingland, koliveir, kshier, kverlaen, lchilton, lhh, link, lmauda, lsvaty, mabashia, manissin, matzew, mbocek, mburns, mcressma, mgarciac, mmagr, mnewsome, mnovotny, nbecker, nobody, odf-bz-bot, omaciel, opohorel, oramraz, owatkins, pbraun, peholase, pgrist, phoracek, pierdipi, pjindal, rgatica, rguimara, rhos-maint, rhuss, rolivier, saroy, sausingh, sdawley, security-response-team, sfeifer, shbose, shvarugh, sidakwo, simaishi, sipoyare, smcdonal, smullick, stcannon, stirabos, teagle, tfister, thason, thavo, tkral, tsweeney, vkumar, wtam, yguenane, zsadeh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	github.com/golang-fips/openssl/v2 2.0.1, github.com/microsoft/go-crypto-openssl/openssl 0.2.9	Doc Type:	If docs needed, set a value
Doc Text:	A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function uses named return parameters to free pkey and ctx if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey and ctx will be nil inside the deferred function that should free them.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2262923, 2262924, 2262925, 2262926, 2262927, 2262928, 2262929, 2262930, 2262931, 2262932, 2262933, 2262934, 2262935, 2262936, 2262937, 2262949, 2262950, 2262951, 2262952, 2262953, 2262954, 2262955, 2262956, 2279584
Bug Blocks:	2262922

Description Avinash Hanwate 2024-02-06 06:06:25 UTC

A memory leak flaw was found in the RSA encrypting/decrypting code which might lead to a resource exhaustion vulnerability, as it is theoretically exploitable using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function uses named return parameters to free pkey and ctx if there is an error initializing the context or setting the different properties. Unfortunately, notice that all the return statements related to error cases follow the "return nil, nil, fail(...)" pattern, which means that pkey and ctx will be nil inside the deferred function that should free them.

Comment 3 Tom Sweeney 2024-02-13 19:18:29 UTC

Any thoughts on a fixed in version yet?  It would be helpful, for the moment, to know the module that's affected.

Comment 12 Anten Skrabec 2024-03-20 21:39:58 UTC

populated fixed in field

Comment 13 Tom Sweeney 2024-03-21 00:53:46 UTC

Thanks for the update.

Comment 16 errata-xmlrpc 2024-03-21 15:39:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:1472 https://access.redhat.com/errata/RHSA-2024:1472

Comment 19 errata-xmlrpc 2024-04-02 19:30:35 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.4 for RHEL 9
  Red Hat Ansible Automation Platform 2.4 for RHEL 8

Via RHSA-2024:1640 https://access.redhat.com/errata/RHSA-2024:1640

Comment 20 errata-xmlrpc 2024-04-02 20:50:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:1644 https://access.redhat.com/errata/RHSA-2024:1644

Comment 21 errata-xmlrpc 2024-04-02 20:50:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:1646 https://access.redhat.com/errata/RHSA-2024:1646

Comment 22 errata-xmlrpc 2024-04-02 21:38:01 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.15

Via RHSA-2024:1563 https://access.redhat.com/errata/RHSA-2024:1563

Comment 23 errata-xmlrpc 2024-04-02 21:54:18 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.15

Via RHSA-2024:1561 https://access.redhat.com/errata/RHSA-2024:1561

Comment 24 errata-xmlrpc 2024-04-03 07:36:31 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.12

Via RHSA-2024:1574 https://access.redhat.com/errata/RHSA-2024:1574

Comment 25 errata-xmlrpc 2024-04-03 16:00:19 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2024:1567 https://access.redhat.com/errata/RHSA-2024:1567

Comment 26 errata-xmlrpc 2024-04-03 16:19:19 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2024:1566 https://access.redhat.com/errata/RHSA-2024:1566

Comment 27 errata-xmlrpc 2024-04-18 18:22:33 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2024:1763 https://access.redhat.com/errata/RHSA-2024:1763

Comment 28 errata-xmlrpc 2024-04-26 20:11:14 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2024:1897 https://access.redhat.com/errata/RHSA-2024:1897

Comment 29 errata-xmlrpc 2024-04-30 14:39:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:2562 https://access.redhat.com/errata/RHSA-2024:2562

Comment 30 errata-xmlrpc 2024-04-30 14:40:35 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:2568 https://access.redhat.com/errata/RHSA-2024:2568

Comment 31 errata-xmlrpc 2024-04-30 14:41:27 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:2569 https://access.redhat.com/errata/RHSA-2024:2569

Comment 33 errata-xmlrpc 2024-05-22 11:40:34 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:3265 https://access.redhat.com/errata/RHSA-2024:3265

Comment 34 errata-xmlrpc 2024-05-22 20:11:48 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 17.1 for RHEL 8

Via RHSA-2024:2767 https://access.redhat.com/errata/RHSA-2024:2767

Comment 35 errata-xmlrpc 2024-05-22 20:38:26 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 17.1 for RHEL 9

Via RHSA-2024:2729 https://access.redhat.com/errata/RHSA-2024:2729

Comment 36 errata-xmlrpc 2024-05-22 20:41:45 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 17.1 for RHEL 9

Via RHSA-2024:2730 https://access.redhat.com/errata/RHSA-2024:2730

Comment 39 Anten Skrabec 2024-06-11 20:05:38 UTC

filed rhel-9 z-stream trackers per https://issues.redhat.com/browse/RHEL-24310?focusedId=24906983&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-24906983

Comment 40 Anten Skrabec 2024-06-11 21:28:00 UTC

wrong component, refiling for rhel-9 containernetworking-plugins

Comment 45 errata-xmlrpc 2024-06-27 00:20:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:4146 https://access.redhat.com/errata/RHSA-2024:4146

Comment 46 errata-xmlrpc 2024-06-27 13:00:52 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.16

Via RHSA-2024:0045 https://access.redhat.com/errata/RHSA-2024:0045

Comment 48 errata-xmlrpc 2024-07-08 13:17:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:4371 https://access.redhat.com/errata/RHSA-2024:4371

Comment 49 errata-xmlrpc 2024-07-08 14:30:59 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:4378 https://access.redhat.com/errata/RHSA-2024:4378

Comment 50 errata-xmlrpc 2024-07-08 14:42:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:4379 https://access.redhat.com/errata/RHSA-2024:4379

Comment 52 errata-xmlrpc 2024-07-15 13:27:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:4502 https://access.redhat.com/errata/RHSA-2024:4502

Comment 53 errata-xmlrpc 2024-07-16 18:40:41 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2024:4581 https://access.redhat.com/errata/RHSA-2024:4581

Comment 54 errata-xmlrpc 2024-07-17 13:13:09 UTC

This issue has been addressed in the following products:

  RHODF-4.16-RHEL-9

Via RHSA-2024:4591 https://access.redhat.com/errata/RHSA-2024:4591

Comment 55 errata-xmlrpc 2024-07-22 01:10:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2024:4672 https://access.redhat.com/errata/RHSA-2024:4672

Comment 57 errata-xmlrpc 2024-07-23 16:23:02 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:4761 https://access.redhat.com/errata/RHSA-2024:4761

Comment 58 errata-xmlrpc 2024-07-23 16:23:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:4762 https://access.redhat.com/errata/RHSA-2024:4762

Comment 59 errata-xmlrpc 2024-07-25 14:16:15 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.15

Via RHSA-2024:4699 https://access.redhat.com/errata/RHSA-2024:4699

Comment 60 errata-xmlrpc 2024-08-07 10:51:52 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2024:4960 https://access.redhat.com/errata/RHSA-2024:4960

Comment 61 errata-xmlrpc 2024-08-13 00:37:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:5258 https://access.redhat.com/errata/RHSA-2024:5258

Comment 62 errata-xmlrpc 2024-08-20 16:07:27 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:5634 https://access.redhat.com/errata/RHSA-2024:5634

Comment 63 errata-xmlrpc 2024-09-26 18:33:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:7262 https://access.redhat.com/errata/RHSA-2024:7262

Comment 73 errata-xmlrpc 2025-05-13 10:03:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:7118 https://access.redhat.com/errata/RHSA-2025:7118