CVE-2021-44717

golang: syscall: don't close fd 0 on ForkExec error

Published Jan 1, 2022 CVSS 3.1 · 4.8 Medium EPSS 2.0% KEV · Not listed
Description
Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.

Analysis

No analysis available yet

Remediation

No remediation available yet

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-2891-1 golang-1.8 security update
Debian DLA Debian DLA DLA-2892-1 golang-1.7 security update
Debian DLA Debian DLA DLA-3395-1 golang-1.11 security update
EUVD EUVD EUVD-2021-31532 Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.
History

No history.

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-404

    Improper Resource Shutdown or Release

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 4, 2024, 4:32 AM
Reserved
Dec 7, 2021, 12:00 AM
Status
Modified
Published
Jan 1, 2022, 5:15 AM
Modified
Jun 17, 2026, 4:12 AM
Severity
Moderate
Public date
Dec 9, 2021, 12:00 AM