Unsanitized NUL in environment variables on Windows in syscall and os/exec

高 7.5CVE-2022-41716 · BIT-golang-2022-41716 · GO-2022-1095 · 02/11/2022 公開 · 17/06/2026 更新

要点

CVE-2022-41716 は stdlib, go (golang) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.0%（全脆弱性の 63.6% より高い）。
対処：1.19.3, 1.18.8 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
stdlib Go	`≥ 1.19.0-0, < 1.19.3< 1.18.8`	`1.19.31.18.8`
go golang	`≥ 1.19.0, < 1.19.3< 1.18.8`	`1.19.31.18.8`

概要

Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows.

In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".

NVD の説明

Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".