CVE-2022-23772
golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.
Rat.SetString en el archivo math/big en Go versiones anteriores a 1.16.14 y versiones 1.17.x anteriores a 1.17.7, presenta un desbordamiento que puede conllevar a un Consumo de Memoria no Controlado
A flaw was found in the big package of the math library in golang. The Rat.SetString could cause an overflow, and if left unhandled, it could lead to excessive memory use. This issue could allow a remote attacker to impact the availability of the system.
Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. Issues addressed include bypass, denial of service, information leakage, and traversal vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-01-20 CVE Reserved
- 2022-02-11 CVE Published
- 2024-08-03 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-190: Integer Overflow or Wraparound
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2022/04/msg00017.html | Mailing List |
|
| https://lists.debian.org/debian-lts-announce/2022/04/msg00018.html | Mailing List |
|
| https://security.netapp.com/advisory/ntap-20220225-0006 | Third Party Advisory |
|
| https://www.oracle.com/security-alerts/cpujul2022.html | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ | 2022-11-09 | |
| https://security.gentoo.org/glsa/202208-02 | 2022-11-09 | |
| https://access.redhat.com/security/cve/CVE-2022-23772 | 2024-09-11 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2053532 | 2024-09-11 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Golang Search vendor "Golang" | Go Search vendor "Golang" for product "Go" | < 1.16.14 Search vendor "Golang" for product "Go" and version " < 1.16.14" | - |
Affected
| ||||||
| Golang Search vendor "Golang" | Go Search vendor "Golang" for product "Go" | >= 1.17.0 < 1.17.7 Search vendor "Golang" for product "Go" and version " >= 1.17.0 < 1.17.7" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Beegfs Csi Driver Search vendor "Netapp" for product "Beegfs Csi Driver" | - | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Cloud Insights Telegraf Agent Search vendor "Netapp" for product "Cloud Insights Telegraf Agent" | - | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Kubernetes Monitoring Operator Search vendor "Netapp" for product "Kubernetes Monitoring Operator" | - | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Storagegrid Search vendor "Netapp" for product "Storagegrid" | - | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||