Skip to main content

Missing Release of Memory after Effective Lifetime

CVE-2024-1394

Severity High
Score 7.5/10

Summary

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs . The memory leak happens in "github.com/golang-fips/openssl/openssl/rsa.go#L113". The objects leaked are "pkey" and "ctx" . That function uses named return parameters to free "pkey " and "ctx" if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that "pkey" and "ctx" will be nil inside the deferred function that should free them. This issue affects the packages github.com/golang-fips/openssl/v2 prior to 2.0.1, github.com/microsoft/go-crypto-openssl versions prior to 0.2.9, and github.com/golang-fips/openssl/openssl in all versions.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-401 - Missing release of memory after effective lifetime (memory leak)

'Missing release of memory after effective lifetime (memory leak)' is a weakness that occurs when software doesn't effectively release allocated memory after it is used. If not addressed, this enables attackers to launch denial of service attacks (by crashing or hanging the program) or take advantage of other unexpected behavior resulting from low memory conditions.

Advisory Timeline

  • Published