id: GO-2024-2824
modules:
    - module: std
      versions:
        - introduced: 1.22.0-0
        - fixed: 1.22.3
      vulnerable_at: 1.22.2
      packages:
        - package: net
          symbols:
            - extractExtendedRCode
          derived_symbols:
            - Dial
            - DialTimeout
            - Dialer.Dial
            - Dialer.DialContext
            - Listen
            - ListenConfig.Listen
            - ListenConfig.ListenPacket
            - ListenPacket
            - LookupAddr
            - LookupCNAME
            - LookupHost
            - LookupIP
            - LookupMX
            - LookupNS
            - LookupSRV
            - LookupTXT
            - ResolveIPAddr
            - ResolveTCPAddr
            - ResolveUDPAddr
            - Resolver.LookupAddr
            - Resolver.LookupCNAME
            - Resolver.LookupHost
            - Resolver.LookupIP
            - Resolver.LookupIPAddr
            - Resolver.LookupMX
            - Resolver.LookupNS
            - Resolver.LookupNetIP
            - Resolver.LookupSRV
            - Resolver.LookupTXT
summary: Malformed DNS message can cause infinite loop in net
description: |-
    A malformed DNS message in response to a query can cause the Lookup functions to
    get stuck in an infinite loop.
credits:
    - '@long-name-let-people-remember-you'
    - Mateusz Poliwczak
references:
    - report: https://go.dev/issue/66754
    - fix: https://go.dev/cl/578375
    - web: https://groups.google.com/g/golang-announce/c/wkkO4P9stm0
cve_metadata:
    id: CVE-2024-24788
    cwe: 'CWE 400: Uncontrolled Resource Consumption'
    references:
        - http://www.openwall.com/lists/oss-security/2024/05/08/3
        - https://security.netapp.com/advisory/ntap-20240605-0002/
        - https://security.netapp.com/advisory/ntap-20240614-0001/
source:
    id: go-security-team
    created: 2024-05-07T16:56:31.886878-04:00
review_status: REVIEWED