Vulnerability-Lookup

BDU:2024-04486 (CVE-2024-24790)

Vulnerability from fstec – Published: 2024-06-13 – Updated: 2024-12-05 – View on bdu.fstec.ru Fixed

Title

Уязвимость компонента net-netip языка программирования Golang, связанная с неправильным контролем доступа, позволяющая нарушителю обойти существующую политику ограничения доступа

Summary

Уязвимость компонента net-netip языка программирования Golang связана с некорректной работой методов Is (IsPrivate, IsLoopback и т. д.). Эксплуатация уязвимости может позволить нарушителю обойти существующую политику ограничения доступа

Severity

5.2 (Medium) CVSS 2.0


                      
                        AV:L/AC:H/Au:N/C:P/I:C/A:P

6.2 (Medium) CVSS 3.0


                      
                        CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Authorization bypass

Incidents

Being clarified

Remediation

Software update

CWE

CWE-284 - Неправильный контроль доступа

Aliases

CVE-2024-24790

References

9 references

URL
https://go.dev/cl/590316
https://go.dev/issue/67680
https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ
https://pkg.go.dev/vuln/GO-2024-2887
https://redos.red-soft.ru/support/secure/
https://www.suse.com/security/cve/CVE-2024-24790.html
https://security-tracker.debian.org/tracker/CVE-2024-24790
https://ubuntu.com/security/CVE-2024-24790
https://access.redhat.com/security/cve/cve-2024-24790

Impacted products

37 products from 7 vendors

Vendors

Canonical Ltd., Novell Inc., Red Hat, Inc., Сообщество свободного программного обеспечения, ООО «Ред Софт», The Go Project

Products

Ubuntu, OpenSUSE Leap, Red Hat Enterprise Linux, Suse Linux Enterprise Server, SUSE Linux Enterprise Server for SAP Applications, SUSE Linux Enterprise Software Development Kit, openSUSE Tumbleweed, Red Hat Storage, Debian GNU/Linux, РЕД ОС (запись в едином реестре российских программ №3751), SUSE Linux Enterprise High Performance Computing, Red Hat Advanced Cluster Management for Kubernetes, Red Hat OpenShift Container Platform, Red Hat OpenStack Platform, SUSE Enterprise Storage, Red Hat Web Terminal, Node Maintenance Operator, OpenShift Developer Tools and Services, Red Hat Ceph Storage, Suse Linux Enterprise Desktop, Service Telemetry Framework, Node HealthCheck Operator, Migration Toolkit for Applications, Migration Toolkit for Virtualization, Red Hat OpenShift Virtualization, OpenShift Serverless, SUSE Linux Enterprise Module for Development Tools, Red Hat Developer Tools, Cryostat, Red Hat Advanced Cluster Security, Migration Toolkit for Containers, OpenShift Pipelines, SUSE Liberty Linux, SUSE Linux Enterprise Module for Containers, Go, Red Hat Ansible Automation Platform, Red Hat Satellite

Versions

16.04 LTS (Ubuntu), 18.04 LTS (Ubuntu), 15.5 (OpenSUSE Leap), 8 (Red Hat Enterprise Linux), 12 SP5 (Suse Linux Enterprise Server), 12 SP5 (SUSE Linux Enterprise Server for SAP Applications), 12 SP5 (SUSE Linux Enterprise Software Development Kit), - (openSUSE Tumbleweed), 3 (Red Hat Storage), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 7.3 (РЕД ОС), 15 SP3 (SUSE Linux Enterprise Server for SAP Applications), 15 SP2 (SUSE Linux Enterprise Server for SAP Applications), 15 SP2-LTSS (SUSE Linux Enterprise High Performance Computing), 2 (Red Hat Advanced Cluster Management for Kubernetes), 4 (Red Hat OpenShift Container Platform), 15 SP4 (SUSE Linux Enterprise Server for SAP Applications), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), 15 SP2-LTSS (Suse Linux Enterprise Server), 16.2 (Red Hat OpenStack Platform), 7.1 (SUSE Enterprise Storage), - (Red Hat Web Terminal), - (Node Maintenance Operator), - (OpenShift Developer Tools and Services), 15 SP3-LTSS (Suse Linux Enterprise Server), 15 SP3-LTSS (SUSE Linux Enterprise High Performance Computing), 5 (Red Hat Ceph Storage), 15 SP5 (SUSE Linux Enterprise Server for SAP Applications), 15 SP5 (Suse Linux Enterprise Server), 15 SP5 (Suse Linux Enterprise Desktop), 1.5 for RHEL 8 (Service Telemetry Framework), - (Node HealthCheck Operator), 6 (Migration Toolkit for Applications), - (Migration Toolkit for Virtualization), 4 (Red Hat OpenShift Virtualization), - (OpenShift Serverless), 15 SP5 (SUSE Linux Enterprise High Performance Computing), 15 SP5 (SUSE Linux Enterprise Module for Development Tools), 4.13 (Red Hat OpenShift Container Platform), - (Red Hat Developer Tools), 4.12 (Red Hat OpenShift Container Platform), 2 (Cryostat), 17.1 (Red Hat OpenStack Platform), 3 (Red Hat Advanced Cluster Security), - (Migration Toolkit for Containers), - (OpenShift Pipelines), 6 (Red Hat Ceph Storage), 9 (SUSE Liberty Linux), 8.8 Extended Update Support (Red Hat Enterprise Linux), 9.2 Extended Update Support (Red Hat Enterprise Linux), 8 (SUSE Liberty Linux), 15 SP4-LTSS (SUSE Linux Enterprise High Performance Computing), 15 SP4-LTSS (Suse Linux Enterprise Server), 4.15 (Red Hat OpenShift Container Platform), 15 SP5 (SUSE Linux Enterprise Module for Containers), 15 SP6 (Suse Linux Enterprise Desktop), 15 SP6 (Suse Linux Enterprise Server), 15 SP6 (SUSE Linux Enterprise Server for SAP Applications), 24.04 LTS (Ubuntu), 15.6 (OpenSUSE Leap), до 1.21.11 (Go), от 1.22.0-0 до 1.22.4 (Go), 15 SP6 (SUSE Linux Enterprise Module for Development Tools), 7 (Red Hat Ceph Storage), 7 (Migration Toolkit for Applications), 7 Extended Lifecycle Support (Red Hat Enterprise Linux), 18.0 (Red Hat OpenStack Platform), 4.14 (Red Hat OpenShift Container Platform), 4.16 (Red Hat OpenShift Container Platform), 15 SP6 (SUSE Linux Enterprise Module for Containers), 3 on RHEL 8 (Cryostat), 4.5 (Red Hat Advanced Cluster Security), 4.6 (Red Hat Advanced Cluster Security), 2.4 for RHEL 8 (Red Hat Ansible Automation Platform), 2.4 for RHEL 9 (Red Hat Ansible Automation Platform), 6.15 for RHEL 8 (Red Hat Satellite)

Product types

Operating system, Application software, Network device, Network software, Appliance software, Virtualization software

Platforms

Canonical Ltd. Ubuntu 16.04 LTS, Canonical Ltd. Ubuntu 18.04 LTS, Novell Inc. OpenSUSE Leap 15.5, Red Hat, Inc. Red Hat Enterprise Linux 8, Novell Inc. Suse Linux Enterprise Server 12 SP5, Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP5, Novell Inc. openSUSE Tumbleweed -, Canonical Ltd. Ubuntu 20.04 LTS, Сообщество свободного программного обеспечения Debian GNU/Linux 11, Сообщество свободного программного обеспечения Debian GNU/Linux 12, ООО «Ред Софт» РЕД ОС 7.3 (запись в едином реестре российских программ №3751), Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP3, Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP2, Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP4, Canonical Ltd. Ubuntu 22.04 LTS, Inc. Red Hat Enterprise Linux 9, Novell Inc. Suse Linux Enterprise Server 15 SP2-LTSS, Novell Inc. Suse Linux Enterprise Server 15 SP3-LTSS, Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP5, Novell Inc. Suse Linux Enterprise Server 15 SP5, Novell Inc. Suse Linux Enterprise Desktop 15 SP5, Novell Inc. SUSE Liberty Linux 9, Inc. Red Hat Enterprise Linux 8.8 Extended Update Support, Inc. Red Hat Enterprise Linux 9.2 Extended Update Support, Novell Inc. SUSE Liberty Linux 8, Novell Inc. Suse Linux Enterprise Server 15 SP4-LTSS, Novell Inc. Suse Linux Enterprise Desktop 15 SP6, Novell Inc. Suse Linux Enterprise Server 15 SP6, Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP6, Canonical Ltd. Ubuntu 24.04 LTS, Novell Inc. OpenSUSE Leap 15.6, Inc. Red Hat Enterprise Linux 7 Extended Lifecycle Support

Mitigations

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года. Использование рекомендаций: Для Go: https://go.dev/cl/590316 https://go.dev/issue/67680 https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ https://pkg.go.dev/vuln/GO-2024-2887 Для РедОС: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/ Для программных продуктов Red Hat Inc.: https://access.redhat.com/security/cve/cve-2024-24790 Для Debian GNU/Linux: https://security-tracker.debian.org/tracker/CVE-2024-24790 Для Ubuntu: https://ubuntu.com/security/CVE-2024-24790 Для программных продуктов Novell Inc.: https://www.suse.com/security/cve/CVE-2024-24790.html

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:H/Au:N/C:P/I:C/A:P",
  "CVSS 3.0": "AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Canonical Ltd., Novell Inc., Red Hat, Inc., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb, The Go Project",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "16.04 LTS (Ubuntu), 18.04 LTS (Ubuntu), 15.5 (OpenSUSE Leap), 8 (Red Hat Enterprise Linux), 12 SP5 (Suse Linux Enterprise Server), 12 SP5 (SUSE Linux Enterprise Server for SAP Applications), 12 SP5 (SUSE Linux Enterprise Software Development Kit), - (openSUSE Tumbleweed), 3 (Red Hat Storage), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 7.3 (\u0420\u0415\u0414 \u041e\u0421), 15 SP3 (SUSE Linux Enterprise Server for SAP Applications), 15 SP2 (SUSE Linux Enterprise Server for SAP Applications), 15 SP2-LTSS (SUSE Linux Enterprise High Performance Computing), 2 (Red Hat Advanced Cluster Management for Kubernetes), 4 (Red Hat OpenShift Container Platform), 15 SP4 (SUSE Linux Enterprise Server for SAP Applications), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), 15 SP2-LTSS (Suse Linux Enterprise Server), 16.2 (Red Hat OpenStack Platform), 7.1 (SUSE Enterprise Storage), - (Red Hat Web Terminal), - (Node Maintenance Operator), - (OpenShift Developer Tools and Services), 15 SP3-LTSS (Suse Linux Enterprise Server), 15 SP3-LTSS (SUSE Linux Enterprise High Performance Computing), 5 (Red Hat Ceph Storage), 15 SP5 (SUSE Linux Enterprise Server for SAP Applications), 15 SP5 (Suse Linux Enterprise Server), 15 SP5 (Suse Linux Enterprise Desktop), 1.5 for RHEL 8 (Service Telemetry Framework), - (Node HealthCheck Operator), 6 (Migration Toolkit for Applications), - (Migration Toolkit for Virtualization), 4 (Red Hat OpenShift Virtualization), - (OpenShift Serverless), 15 SP5 (SUSE Linux Enterprise High Performance Computing), 15 SP5 (SUSE Linux Enterprise Module for Development Tools), 4.13 (Red Hat OpenShift Container Platform), - (Red Hat Developer Tools), 4.12 (Red Hat OpenShift Container Platform), 2 (Cryostat), 17.1 (Red Hat OpenStack Platform), 3 (Red Hat Advanced Cluster Security), - (Migration Toolkit for Containers), - (OpenShift Pipelines), 6 (Red Hat Ceph Storage), 9 (SUSE Liberty Linux), 8.8 Extended Update Support (Red Hat Enterprise Linux), 9.2 Extended Update Support (Red Hat Enterprise Linux), 8 (SUSE Liberty Linux), 15 SP4-LTSS (SUSE Linux Enterprise High Performance Computing), 15 SP4-LTSS (Suse Linux Enterprise Server), 4.15 (Red Hat OpenShift Container Platform), 15 SP5 (SUSE Linux Enterprise Module for Containers), 15 SP6 (Suse Linux Enterprise Desktop), 15 SP6 (Suse Linux Enterprise Server), 15 SP6 (SUSE Linux Enterprise Server for SAP Applications), 24.04 LTS (Ubuntu), 15.6 (OpenSUSE Leap), \u0434\u043e 1.21.11 (Go), \u043e\u0442 1.22.0-0 \u0434\u043e 1.22.4 (Go), 15 SP6 (SUSE Linux Enterprise Module for Development Tools), 7 (Red Hat Ceph Storage), 7 (Migration Toolkit for Applications), 7 Extended Lifecycle Support (Red Hat Enterprise Linux), 18.0 (Red Hat OpenStack Platform), 4.14 (Red Hat OpenShift Container Platform), 4.16 (Red Hat OpenShift Container Platform), 15 SP6 (SUSE Linux Enterprise Module for Containers), 3 on RHEL 8 (Cryostat), 4.5 (Red Hat Advanced Cluster Security), 4.6 (Red Hat Advanced Cluster Security), 2.4 for RHEL 8 (Red Hat Ansible Automation Platform), 2.4 for RHEL 9 (Red Hat Ansible Automation Platform), 6.15 for RHEL 8 (Red Hat Satellite)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Go:\nhttps://go.dev/cl/590316 \nhttps://go.dev/issue/67680 \nhttps://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ \nhttps://pkg.go.dev/vuln/GO-2024-2887\n\n\u0414\u043b\u044f \u0420\u0435\u0434\u041e\u0421: \nhttp://repo.red-soft.ru/redos/7.3c/x86_64/updates/\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/cve-2024-24790\n\n\u0414\u043b\u044f Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2024-24790\n\n\u0414\u043b\u044f Ubuntu:\nhttps://ubuntu.com/security/CVE-2024-24790\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Novell Inc.:\nhttps://www.suse.com/security/cve/CVE-2024-24790.html",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "05.06.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "05.12.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "13.06.2024",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-04486",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-24790",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Ubuntu, OpenSUSE Leap, Red Hat Enterprise Linux, Suse Linux Enterprise Server, SUSE Linux Enterprise Server for SAP Applications, SUSE Linux Enterprise Software Development Kit, openSUSE Tumbleweed, Red Hat Storage, Debian GNU/Linux, \u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), SUSE Linux Enterprise High Performance Computing, Red Hat Advanced Cluster Management for Kubernetes, Red Hat OpenShift Container Platform, Red Hat OpenStack Platform, SUSE Enterprise Storage, Red Hat Web Terminal, Node Maintenance Operator, OpenShift Developer Tools and Services, Red Hat Ceph Storage, Suse Linux Enterprise Desktop, Service Telemetry Framework, Node HealthCheck Operator, Migration Toolkit for Applications, Migration Toolkit for Virtualization, Red Hat OpenShift Virtualization, OpenShift Serverless, SUSE Linux Enterprise Module for Development Tools, Red Hat Developer Tools, Cryostat, Red Hat Advanced Cluster Security, Migration Toolkit for Containers, OpenShift Pipelines, SUSE Liberty Linux, SUSE Linux Enterprise Module for Containers, Go, Red Hat Ansible Automation Platform, Red Hat Satellite",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Canonical Ltd. Ubuntu 16.04 LTS , Canonical Ltd. Ubuntu 18.04 LTS , Novell Inc. OpenSUSE Leap 15.5 , Red Hat, Inc. Red Hat Enterprise Linux 8 , Novell Inc. Suse Linux Enterprise Server 12 SP5 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP5 , Novell Inc. openSUSE Tumbleweed - , Canonical Ltd. Ubuntu 20.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 11 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 12 , \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 7.3  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP3 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP2 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP4 , Canonical Ltd. Ubuntu 22.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 9 , Novell Inc. Suse Linux Enterprise Server 15 SP2-LTSS , Novell Inc. Suse Linux Enterprise Server 15 SP3-LTSS , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP5 , Novell Inc. Suse Linux Enterprise Server 15 SP5 , Novell Inc. Suse Linux Enterprise Desktop 15 SP5 , Novell Inc. SUSE Liberty Linux 9 , Red Hat, Inc. Red Hat Enterprise Linux 8.8 Extended Update Support , Red Hat, Inc. Red Hat Enterprise Linux 9.2 Extended Update Support , Novell Inc. SUSE Liberty Linux 8 , Novell Inc. Suse Linux Enterprise Server 15 SP4-LTSS , Novell Inc. Suse Linux Enterprise Desktop 15 SP6 , Novell Inc. Suse Linux Enterprise Server 15 SP6 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP6 , Canonical Ltd. Ubuntu 24.04 LTS , Novell Inc. OpenSUSE Leap 15.6 , Red Hat, Inc. Red Hat Enterprise Linux 7 Extended Lifecycle Support ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 net-netip \u044f\u0437\u044b\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Golang, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u043c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0443\u044e \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u0430 (CWE-284)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 net-netip \u044f\u0437\u044b\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Golang \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u043e\u0439 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 Is (IsPrivate, IsLoopback \u0438 \u0442. \u0434.). \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0443\u044e \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://go.dev/cl/590316\nhttps://go.dev/issue/67680\nhttps://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ\nhttps://pkg.go.dev/vuln/GO-2024-2887\nhttps://redos.red-soft.ru/support/secure/\nhttps://www.suse.com/security/cve/CVE-2024-24790.html\nhttps://security-tracker.debian.org/tracker/CVE-2024-24790\nhttps://ubuntu.com/security/CVE-2024-24790\nhttps://access.redhat.com/security/cve/cve-2024-24790",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430, \u041f\u041e \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438/\u041f\u041e \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-284",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,2)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,2)"
}

CVE-2024-24790 (GCVE-0-2024-24790)

Vulnerability from cvelistv5 – Published: 2024-06-05 15:13 – Updated: 2025-02-13 17:40

Title

Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

Summary

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-07 14:59 UTC

CWE

CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize

Assigner

Go Google root Scorecard

References

6 references

URL	Tags
https://go.dev/cl/590316
https://go.dev/issue/67680
https://groups.google.com/g/golang-announce/c/Xbx…
https://pkg.go.dev/vuln/GO-2024-2887
http://www.openwall.com/lists/oss-security/2024/06/04/1
https://security.netapp.com/advisory/ntap-2024090…

Impacted products

2 products

Vendor	Product	Version
Go standard library	net/netip	Affected: 0 , < 1.21.11 (semver) Affected: 1.22.0-0 , < 1.22.4 (semver)
golang	go	Affected: 0 , < 1.21.11 (semver) Affected: 1.22.0-0 , < 1.22.4 (semver) cpe:2.3:a:golang:go::::::::

Credits

Enze Wang of Alioth (@zer0yu) Jianjun Chen of Zhongguancun Lab (@chenjj)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-09-05T08:03:29.294Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/590316"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/67680"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2024-2887"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/06/04/1"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20240905-0002/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "go",
            "vendor": "golang",
            "versions": [
              {
                "lessThan": "1.21.11",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThan": "1.22.4",
                "status": "affected",
                "version": "1.22.0-0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-24790",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-07T14:59:19.414359Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T17:47:16.286Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/netip",
          "product": "net/netip",
          "programRoutines": [
            {
              "name": "Addr.IsLoopback"
            },
            {
              "name": "Addr.IsMulticast"
            },
            {
              "name": "Addr.IsInterfaceLocalMulticast"
            },
            {
              "name": "Addr.IsLinkLocalMulticast"
            },
            {
              "name": "Addr.IsGlobalUnicast"
            },
            {
              "name": "Addr.IsPrivate"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.21.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.22.4",
              "status": "affected",
              "version": "1.22.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Enze Wang of Alioth (@zer0yu)"
        },
        {
          "lang": "en",
          "value": "Jianjun Chen of Zhongguancun Lab (@chenjj)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-180: Incorrect Behavior Order: Validate Before Canonicalize",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-10T17:11:30.724Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/590316"
        },
        {
          "url": "https://go.dev/issue/67680"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-2887"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/06/04/1"
        }
      ],
      "title": "Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2024-24790",
    "datePublished": "2024-06-05T15:13:50.527Z",
    "dateReserved": "2024-01-30T16:05:14.758Z",
    "dateUpdated": "2025-02-13T17:40:28.639Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2024-04486 (CVE-2024-24790)

CVE-2024-24790 (GCVE-0-2024-24790)

Tags

Sightings

Nomenclature

Related by attack behaviour