CVE-2022-41716 Unsanitized NUL in environment variables on Windows in syscall and os/exec

2022-11-0215:28:19

github.com

cve-2022-41716

unsanitized nul

windows

syscall

os/exec

environment variables

malicious

startprocess

cmd

AI Score

6.5

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string “A=B\x00C=D” sets the variables “A=B” and “C=D”.

CNA Affected

[
  {
    "vendor": "Go standard library",
    "product": "syscall",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.18.8",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "1.19.0-0",
        "lessThan": "1.19.3",
        "versionType": "semver"
      }
    ],
    "platforms": [
      "windows"
    ],
    "packageName": "syscall",
    "collectionURL": "https://pkg.go.dev",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "StartProcess"
      }
    ]
  },
  {
    "vendor": "Go standard library",
    "product": "os/exec",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.18.8",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "1.19.0-0",
        "lessThan": "1.19.3",
        "versionType": "semver"
      }
    ],
    "platforms": [
      "windows"
    ],
    "packageName": "os/exec",
    "collectionURL": "https://pkg.go.dev",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "Cmd.environ"
      },
      {
        "name": "dedupEnv"
      },
      {
        "name": "dedupEnvCase"
      },
      {
        "name": "Cmd.CombinedOutput"
      },
      {
        "name": "Cmd.Environ"
      },
      {
        "name": "Cmd.Output"
      },
      {
        "name": "Cmd.Run"
      },
      {
        "name": "Cmd.Start"
      }
    ]
  }
]