GO-2021-0263

vendorUSosv

Panic on invalid symbol tables in debug/macho

view advisory published 2022-01-13Licence: per source

Calling File.ImportedSymbols on a loaded file which contains an invalid dynamic symbol table command can cause a panic, in particular if the encoded number of undefined symbols is larger than the number of symbols in the symbol table.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-41771US	high7.5	4.70% (92nd)	—	2021-11-08
ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice…

references

External citations — patches, advisories, analysis.

https://go.dev/cl/367075FIX
https://go.dev/issue/48990REPORT
https://go.googlesource.com/go/+/61536ec03063b4951163bd09609c86d82631fa27FIX
https://groups.google.com/g/golang-announce/c/0fM21h43arcWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan