Upstream information
CVE-2024-1394 at MITRE
Description
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function uses named return parameters to free pkey and ctx if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey and ctx will be nil inside the deferred function that should free them.
Other Security Trackers
Overall state of this security issue: Does not affect SUSE products
This issue is currently rated as having important severity.
CVSS v3 Scores
| CVSS detail | CNA (Red Hat) |
|---|
| Base Score | 7.5 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality Impact | None |
| Integrity Impact | None |
| Availability Impact | High |
| CVSSv3 Version | 3.1 |
No SUSE Bugzilla entries cross referenced.
No SUSE Security Announcements cross referenced.
List of released packages
| Product(s) | Fixed package version(s) | References |
|---|
| SUSE Liberty Linux 8 | aardvark-dns >= 1.10.0-1.module+el8.10.0+22202+761b9a65buildah >= 1.33.8-4.module+el8.10.0+22202+761b9a65buildah-tests >= 1.33.8-4.module+el8.10.0+22202+761b9a65cockpit-podman >= 84.1-1.module+el8.10.0+22202+761b9a65conmon >= 2.1.10-1.module+el8.10.0+22202+761b9a65container-selinux >= 2.229.0-2.module+el8.10.0+22202+761b9a65containernetworking-plugins >= 1.4.0-5.module+el8.10.0+22202+761b9a65containers-common >= 1-82.module+el8.10.0+22202+761b9a65crit >= 3.18-5.module+el8.10.0+22202+761b9a65criu >= 3.18-5.module+el8.10.0+22202+761b9a65criu-devel >= 3.18-5.module+el8.10.0+22202+761b9a65criu-libs >= 3.18-5.module+el8.10.0+22202+761b9a65crun >= 1.14.3-2.module+el8.10.0+22202+761b9a65delve >= 1.20.2-1.module+el8.9.0+18926+5193682dfuse-overlayfs >= 1.13-1.module+el8.10.0+22202+761b9a65go-toolset >= 1.20.12-1.module+el8.9.0+21033+5795bdf6golang >= 1.20.12-3.module+el8.9.0+21528+703c3aa2golang-bin >= 1.20.12-3.module+el8.9.0+21528+703c3aa2golang-docs >= 1.20.12-3.module+el8.9.0+21528+703c3aa2golang-misc >= 1.20.12-3.module+el8.9.0+21528+703c3aa2golang-src >= 1.20.12-3.module+el8.9.0+21528+703c3aa2golang-tests >= 1.20.12-3.module+el8.9.0+21528+703c3aa2grafana >= 9.2.10-16.el8_10grafana-pcp >= 5.1.1-2.el8_9grafana-selinux >= 9.2.10-16.el8_10libslirp >= 4.4.0-2.module+el8.10.0+22202+761b9a65libslirp-devel >= 4.4.0-2.module+el8.10.0+22202+761b9a65netavark >= 1.10.3-1.module+el8.10.0+22202+761b9a65oci-seccomp-bpf-hook >= 1.2.10-1.module+el8.10.0+22202+761b9a65podman >= 4.9.4-12.module+el8.10.0+22202+761b9a65podman-catatonit >= 4.9.4-12.module+el8.10.0+22202+761b9a65podman-docker >= 4.9.4-12.module+el8.10.0+22202+761b9a65podman-gvproxy >= 4.9.4-12.module+el8.10.0+22202+761b9a65podman-plugins >= 4.9.4-12.module+el8.10.0+22202+761b9a65podman-remote >= 4.9.4-12.module+el8.10.0+22202+761b9a65podman-tests >= 4.9.4-12.module+el8.10.0+22202+761b9a65python3-criu >= 3.18-5.module+el8.10.0+22202+761b9a65python3-podman >= 4.9.0-2.module+el8.10.0+22202+761b9a65runc >= 1.1.12-4.module+el8.10.0+22202+761b9a65skopeo >= 1.14.5-3.module+el8.10.0+22202+761b9a65skopeo-tests >= 1.14.5-3.module+el8.10.0+22202+761b9a65slirp4netns >= 1.2.3-1.module+el8.10.0+22202+761b9a65toolbox >= 0.0.99.5-2.module+el8.10.0+22202+761b9a65toolbox-tests >= 0.0.99.5-2.module+el8.10.0+22202+761b9a65udica >= 0.2.6-21.module+el8.10.0+22202+761b9a65
| Patchnames:
RHSA-2024:1472
RHSA-2024:1644
RHSA-2024:1646
RHSA-2024:3265
RHSA-2024:5258 |
| SUSE Liberty Linux 9 | buildah >= 1.33.7-3.el9_4buildah-tests >= 1.33.7-3.el9_4containernetworking-plugins >= 1.4.0-4.el9_4go-toolset >= 1.21.9-2.el9_4golang >= 1.21.9-2.el9_4golang-bin >= 1.21.9-2.el9_4golang-docs >= 1.21.9-2.el9_4golang-misc >= 1.21.9-2.el9_4golang-src >= 1.21.9-2.el9_4golang-tests >= 1.21.9-2.el9_4grafana >= 9.2.10-16.el9_4grafana-pcp >= 5.1.1-2.el9_4grafana-selinux >= 9.2.10-16.el9_4gvisor-tap-vsock >= 0.7.3-4.el9_4podman >= 4.9.4-5.el9_4podman-docker >= 4.9.4-5.el9_4podman-plugins >= 4.9.4-5.el9_4podman-remote >= 4.9.4-5.el9_4podman-tests >= 4.9.4-5.el9_4runc >= 1.1.12-3.el9_4skopeo >= 1.14.3-3.el9_4skopeo-tests >= 1.14.3-3.el9_4
| Patchnames:
RHSA-2024:1462
RHSA-2024:1501
RHSA-2024:1502
RHSA-2024:2562
RHSA-2024:2568
RHSA-2024:2569
RHSA-2024:4371
RHSA-2024:4378
RHSA-2024:4379
RHSA-2024:4502
RHSA-2024:4761
RHSA-2024:4762 |
SUSE Timeline for this CVE
CVE page created: Wed Mar 20 19:00:16 2024
CVE page last modified: Mon Oct 6 19:51:24 2025
