CVE-2024-24790

Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

Los diversos métodos Is (IsPrivate, IsLoopback, etc.) no funcionaron como se esperaba para las direcciones IPv6 asignadas a IPv4, devolviendo falso para direcciones que devolverían verdadero en sus formas IPv4 tradicionales.

A flaw was found in the Go language standard library net/netip. The method Is*() (IsPrivate(), IsPublic(), etc) doesn't behave properly when working with IPv6 mapped to IPv4 addresses. The unexpected behavior can lead to integrity and confidentiality issues, specifically when these methods are used to control access to resources or data.

*Credits: Enze Wang of Alioth (@zer0yu), Jianjun Chen of Zhongguancun Lab (@chenjj)

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

None

Automatable

Yes

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2024-01-30 CVE Reserved
2024-06-05 CVE Published
2024-06-19 EPSS Updated
2024-09-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-115: Misinterpretation of Input

CAPEC

References (7)

URL	Tag	Source
http://www.openwall.com/lists/oss-security/2024/06/04/1	Mailing List
https://go.dev/issue/67680	Issue Tracking
https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ	Release Notes
https://pkg.go.dev/vuln/GO-2024-2887	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://go.dev/cl/590316	2024-06-18

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2024-24790	2024-09-18
https://bugzilla.redhat.com/show_bug.cgi?id=2292787	2024-09-18

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Golang Search vendor "Golang"		Go Search vendor "Golang" for product "Go"				< 1.21.11 Search vendor "Golang" for product "Go" and version " < 1.21.11"		-		Affected
Golang Search vendor "Golang"		Go Search vendor "Golang" for product "Go"				>= 1.22.0 < 1.22.4 Search vendor "Golang" for product "Go" and version " >= 1.22.0 < 1.22.4"		-		Affected