CVE-2024-1394 | THREATINT

Description

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function uses named return parameters to free pkey and ctx if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey and ctx will be nil inside the deferred function that should free them.

PUBLISHED Reserved 2024-02-09 | Published 2024-03-21 | Updated 2025-11-13 | Assigner redhat

HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Problem types

Missing Release of Memory after Effective Lifetime

Product status

Default status

affected

0:1.4.5-1.el8ap (rpm) before *

unaffected

Default status

affected

0:1.4.5-1.el9ap (rpm) before *

unaffected

Default status

affected

0:1.19.13-6.el7_9 (rpm) before *

unaffected

Default status

affected

8090020240313170136.26eb71ac (rpm) before *

unaffected

Default status

affected

0:5.1.1-2.el8_9 (rpm) before *

unaffected

Default status

affected

0:9.2.10-8.el8_9 (rpm) before *

unaffected

Default status

affected

0:9.2.10-16.el8_10 (rpm) before *

unaffected

Default status

affected

8100020240808093819.afee755d (rpm) before *

unaffected

Default status

affected

0:101-2.el8_10 (rpm) before *

unaffected

Default status

affected

0:1.20.12-2.el9_3 (rpm) before *

unaffected

Default status

affected

0:9.2.10-8.el9_3 (rpm) before *

unaffected

Default status

affected

0:5.1.1-2.el9_3 (rpm) before *

unaffected

Default status

affected

0:1.21.9-2.el9_4 (rpm) before *

unaffected

Default status

affected

0:9.2.10-16.el9_4 (rpm) before *

unaffected

Default status

affected

0:5.1.1-2.el9_4 (rpm) before *

unaffected

Default status

affected

2:1.33.7-3.el9_4 (rpm) before *

unaffected

Default status

affected

4:4.9.4-5.el9_4 (rpm) before *

unaffected

Default status

affected

6:0.7.3-4.el9_4 (rpm) before *

unaffected

Default status

affected

2:1.14.3-3.el9_4 (rpm) before *

unaffected

Default status

affected

1:1.4.0-4.el9_4 (rpm) before *

unaffected

Default status

affected

4:1.1.12-3.el9_4 (rpm) before *

unaffected

Default status

affected

0:132-1.el9 (rpm) before *

unaffected

Default status

affected

2:4.2.0-4.el9_0 (rpm) before *

unaffected

Default status

affected

1:1.0.1-6.el9_0 (rpm) before *

unaffected

Default status

affected

0:1.19.13-7.el9_2 (rpm) before *

unaffected

Default status

affected

2:4.4.1-20.el9_2 (rpm) before *

unaffected

Default status

affected

1:1.23.4-5.2.rhaos4.12.el9 (rpm) before *

unaffected

Default status

affected

0:0.16.0-2.2.rhaos4.12.el8 (rpm) before *

unaffected

Default status

affected

1:1.4.0-1.1.rhaos4.12.el8 (rpm) before *

unaffected

Default status

affected

0:1.25.3-5.2.rhaos4.12.git44a2cb2.el9 (rpm) before *

unaffected

Default status

affected

0:1.25.0-2.2.el8 (rpm) before *

unaffected

Default status

affected

0:2.14.0-5.2.rhaos4.12.el9 (rpm) before *

unaffected

Default status

affected

0:4.12.0-202403251017.p0.gd4c9e3c.assembly.stream.el9 (rpm) before *

unaffected

Default status

affected

3:4.2.0-7.2.rhaos4.12.el9 (rpm) before *

unaffected

Default status

affected

3:1.1.6-5.2.rhaos4.12.el8 (rpm) before *

unaffected

Default status

affected

2:1.9.4-3.2.rhaos4.12.el8 (rpm) before *

unaffected

Default status

affected

1:1.29.1-2.2.rhaos4.13.el8 (rpm) before *

unaffected

Default status

affected

1:1.4.0-1.1.rhaos4.13.el8 (rpm) before *

unaffected

Default status

affected

0:1.26.5-11.1.rhaos4.13.git919cc6e.el9 (rpm) before *

unaffected

Default status

affected

0:1.26.0-4.2.el9 (rpm) before *

unaffected

Default status

affected

0:2.15.0-7.1.rhaos4.13.el9 (rpm) before *

unaffected

Default status

affected

0:4.13.0-202404020737.p0.gd192e90.assembly.stream.el8 (rpm) before *

unaffected

Default status

affected

3:4.4.1-6.2.rhaos4.13.el9 (rpm) before *

unaffected

Default status

affected

4:1.1.12-1.1.rhaos4.13.el8 (rpm) before *

unaffected

Default status

affected

2:1.11.2-2.2.rhaos4.13.el9 (rpm) before *

unaffected

Default status

affected

0:0.19.0-1.3.rhaos4.14.el8 (rpm) before *

unaffected

Default status

affected

1:1.4.0-1.2.rhaos4.14.el8 (rpm) before *

unaffected

Default status

affected

0:1.27.4-6.1.rhaos4.14.gitd09e4c0.el9 (rpm) before *

unaffected

Default status

affected

0:1.27.0-3.1.el8 (rpm) before *

unaffected

Default status

affected

0:2.16.2-2.1.rhaos4.14.el9 (rpm) before *

unaffected

Default status

affected

0:4.14.0-202403261640.p0.gf7b14a9.assembly.stream.el8 (rpm) before *

unaffected

Default status

affected

0:4.14.0-202403251040.p0.g607e2dd.assembly.stream.el8 (rpm) before *

unaffected

Default status

affected

3:4.4.1-11.3.rhaos4.14.el9 (rpm) before *

unaffected

Default status

affected

2:1.11.2-10.3.rhaos4.14.el9 (rpm) before *

unaffected

Default status

affected

1:1.29.1-10.4.rhaos4.14.el8 (rpm) before *

unaffected

Default status

affected

0:0.19.0-1.4.rhaos4.14.el8 (rpm) before *

unaffected

Default status

affected

3:2.1.7-3.4.rhaos4.14.el9 (rpm) before *

unaffected

Default status

affected

1:1.4.0-1.3.rhaos4.14.el8 (rpm) before *

unaffected

Default status

affected

0:1.27.4-7.2.rhaos4.14.git082c52f.el9 (rpm) before *

unaffected

Default status

affected

0:1.27.0-3.2.el8 (rpm) before *

unaffected

Default status

affected

0:2.16.2-2.2.rhaos4.14.el9 (rpm) before *

unaffected

Default status

affected

0:4.14.0-202404160939.p0.g7bee54d.assembly.stream.el8 (rpm) before *

unaffected

Default status

affected

0:4.14.0-202404151639.p0.gd2acdd5.assembly.stream.el8 (rpm) before *

unaffected

Default status

affected

0:4.14.0-202404151639.p0.g81558cc.assembly.stream.el8 (rpm) before *

unaffected

Default status

affected

0:4.14.0-202404151639.p0.gf7b14a9.assembly.stream.el9 (rpm) before *

unaffected

Default status

affected

0:4.14.0-202404151639.p0.g8926a29.assembly.stream.el8 (rpm) before *

unaffected

Default status

affected

0:4.14.0-202404151639.p0.g607e2dd.assembly.stream.el8 (rpm) before *

unaffected

Default status

affected

3:4.4.1-11.4.rhaos4.14.el8 (rpm) before *

unaffected

Default status

affected

4:1.1.12-1.2.rhaos4.14.el8 (rpm) before *

unaffected

Default status

affected

2:1.11.2-10.4.rhaos4.14.el8 (rpm) before *

unaffected

Default status

affected

0:4.14.19-202403280926.p0.gc1f8861.assembly.4.14.19.el9 (rpm) before *

unaffected

Default status

affected

414.92.202407300859-0 (rpm) before *

unaffected

Default status

affected

1:1.29.1-20.3.rhaos4.15.el8 (rpm) before *

unaffected

Default status

affected

0:0.20.0-1.1.rhaos4.15.el8 (rpm) before *

unaffected

Default status

affected

1:1.4.0-1.2.rhaos4.15.el8 (rpm) before *

unaffected

Default status

affected

0:1.28.4-8.rhaos4.15.git24f50b9.el9 (rpm) before *

unaffected

Default status

affected

0:1.28.0-3.1.el8 (rpm) before *

unaffected

Default status

affected

0:2.16.2-2.1.rhaos4.15.el9 (rpm) before *

unaffected

Default status

affected

0:4.15.0-202403211240.p0.g62c4d45.assembly.stream.el8 (rpm) before *

unaffected

Default status

affected

0:4.15.0-202403211549.p0.g2e3cca1.assembly.stream.el9 (rpm) before *

unaffected

Default status

affected

3:4.4.1-21.1.rhaos4.15.el8 (rpm) before *

unaffected

Default status

affected

4:1.1.12-1.1.rhaos4.15.el8 (rpm) before *

unaffected

Default status

affected

2:1.11.2-21.2.rhaos4.15.el8 (rpm) before *

unaffected

Default status

affected

0:4.15.6-202403280951.p0.g94b1c2a.assembly.4.15.6.el9 (rpm) before *

unaffected

Default status

affected

415.92.202407191425-0 (rpm) before *

unaffected

Default status

affected

0:3.3.23-16.el8ost (rpm) before *

unaffected

Default status

affected

0:0.2.1-3.el8ost (rpm) before *

unaffected

Default status

affected

0:3.4.26-8.el9ost (rpm) before *

unaffected

Default status

affected

0:0.2.1-3.el9ost (rpm) before *

unaffected

Default status

affected

v4.16.0-137 (rpm) before *

unaffected

Default status

affected

v4.16.0-38 (rpm) before *

unaffected

Default status

affected

Default status

affected

Default status

affected

Default status

unaffected

Default status

affected

Default status

affected

Default status

affected

Default status

unaffected

Default status

affected

Default status

affected

Default status

unknown

Default status

unknown

Default status

unknown

Default status

unknown

Default status

unknown

Default status

unknown

Default status

unaffected

Default status

unaffected

Default status

unaffected

Default status

unaffected

Default status

unaffected

Default status

unaffected

Default status

unaffected

Default status

unaffected

Default status

unaffected

Default status

unaffected

Default status

affected

Default status

unaffected

Default status

unaffected

Default status

affected

Default status

unaffected

Default status

unaffected

Default status

unaffected

Default status

unaffected

Default status

unaffected

Default status

unknown

Default status

unaffected

Default status

unaffected

Default status

affected

Default status

unknown

Default status

affected

Default status

affected

Default status

affected

Default status

unaffected

Default status

unknown

Default status

affected

Default status

unaffected

Default status

affected

Default status

affected

Default status

unaffected

Default status

affected

Default status

affected

Default status

unaffected

Default status

affected

Default status

affected

Default status

affected

Default status

affected

Default status

unaffected

Default status

unknown

Timeline

2024-02-06:	Reported to Red Hat.
2024-03-20:	Made public.

Credits

Red Hat would like to thank @qmuntal and @r3kumar for reporting this issue.

References

access.redhat.com/errata/RHSA-2024:1462 (RHSA-2024:1462) vendor-advisory

access.redhat.com/errata/RHSA-2024:1468 (RHSA-2024:1468) vendor-advisory

access.redhat.com/errata/RHSA-2024:1472 (RHSA-2024:1472) vendor-advisory

access.redhat.com/errata/RHSA-2024:1501 (RHSA-2024:1501) vendor-advisory

access.redhat.com/errata/RHSA-2024:1502 (RHSA-2024:1502) vendor-advisory

access.redhat.com/errata/RHSA-2024:1561 (RHSA-2024:1561) vendor-advisory

access.redhat.com/errata/RHSA-2024:1563 (RHSA-2024:1563) vendor-advisory

access.redhat.com/errata/RHSA-2024:1566 (RHSA-2024:1566) vendor-advisory

access.redhat.com/errata/RHSA-2024:1567 (RHSA-2024:1567) vendor-advisory

access.redhat.com/errata/RHSA-2024:1574 (RHSA-2024:1574) vendor-advisory

access.redhat.com/errata/RHSA-2024:1640 (RHSA-2024:1640) vendor-advisory

access.redhat.com/errata/RHSA-2024:1644 (RHSA-2024:1644) vendor-advisory

access.redhat.com/errata/RHSA-2024:1646 (RHSA-2024:1646) vendor-advisory

access.redhat.com/errata/RHSA-2024:1763 (RHSA-2024:1763) vendor-advisory

access.redhat.com/errata/RHSA-2024:1897 (RHSA-2024:1897) vendor-advisory

access.redhat.com/errata/RHSA-2024:2562 (RHSA-2024:2562) vendor-advisory

access.redhat.com/errata/RHSA-2024:2568 (RHSA-2024:2568) vendor-advisory

access.redhat.com/errata/RHSA-2024:2569 (RHSA-2024:2569) vendor-advisory

access.redhat.com/errata/RHSA-2024:2729 (RHSA-2024:2729) vendor-advisory

access.redhat.com/errata/RHSA-2024:2730 (RHSA-2024:2730) vendor-advisory

access.redhat.com/errata/RHSA-2024:2767 (RHSA-2024:2767) vendor-advisory

access.redhat.com/errata/RHSA-2024:3265 (RHSA-2024:3265) vendor-advisory

access.redhat.com/errata/RHSA-2024:3352 (RHSA-2024:3352) vendor-advisory

access.redhat.com/errata/RHSA-2024:4146 (RHSA-2024:4146) vendor-advisory

access.redhat.com/errata/RHSA-2024:4371 (RHSA-2024:4371) vendor-advisory

access.redhat.com/errata/RHSA-2024:4378 (RHSA-2024:4378) vendor-advisory

access.redhat.com/errata/RHSA-2024:4379 (RHSA-2024:4379) vendor-advisory

access.redhat.com/errata/RHSA-2024:4502 (RHSA-2024:4502) vendor-advisory

access.redhat.com/errata/RHSA-2024:4581 (RHSA-2024:4581) vendor-advisory

access.redhat.com/errata/RHSA-2024:4591 (RHSA-2024:4591) vendor-advisory

access.redhat.com/errata/RHSA-2024:4672 (RHSA-2024:4672) vendor-advisory

access.redhat.com/errata/RHSA-2024:4699 (RHSA-2024:4699) vendor-advisory

access.redhat.com/errata/RHSA-2024:4761 (RHSA-2024:4761) vendor-advisory

access.redhat.com/errata/RHSA-2024:4762 (RHSA-2024:4762) vendor-advisory

access.redhat.com/security/cve/CVE-2024-1394 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2262921 (RHBZ#2262921) issue-tracking

github.com/...ommit/85d31d0d257ce842c8a1e63c4d230ae850348136

github.com/...penssl/security/advisories/GHSA-78hx-gp6g-7mj6

github.com/...ommit/104fe7f6912788d2ad44602f77a0a0a62f1f259f

pkg.go.dev/vuln/GO-2024-2660

vuln.go.dev/ID/GO-2024-2660.json

access.redhat.com/errata/RHSA-2024:1462 (RHSA-2024:1462) vendor-advisory

access.redhat.com/errata/RHSA-2024:1468 (RHSA-2024:1468) vendor-advisory

access.redhat.com/errata/RHSA-2024:1472 (RHSA-2024:1472) vendor-advisory

access.redhat.com/errata/RHSA-2024:1501 (RHSA-2024:1501) vendor-advisory

access.redhat.com/errata/RHSA-2024:1502 (RHSA-2024:1502) vendor-advisory

access.redhat.com/errata/RHSA-2024:1561 (RHSA-2024:1561) vendor-advisory

access.redhat.com/errata/RHSA-2024:1563 (RHSA-2024:1563) vendor-advisory

access.redhat.com/errata/RHSA-2024:1566 (RHSA-2024:1566) vendor-advisory

access.redhat.com/errata/RHSA-2024:1567 (RHSA-2024:1567) vendor-advisory

access.redhat.com/errata/RHSA-2024:1574 (RHSA-2024:1574) vendor-advisory

access.redhat.com/errata/RHSA-2024:1640 (RHSA-2024:1640) vendor-advisory

access.redhat.com/errata/RHSA-2024:1644 (RHSA-2024:1644) vendor-advisory

access.redhat.com/errata/RHSA-2024:1646 (RHSA-2024:1646) vendor-advisory

access.redhat.com/errata/RHSA-2024:1763 (RHSA-2024:1763) vendor-advisory

access.redhat.com/errata/RHSA-2024:1897 (RHSA-2024:1897) vendor-advisory

access.redhat.com/errata/RHSA-2024:2562 (RHSA-2024:2562) vendor-advisory

access.redhat.com/errata/RHSA-2024:2568 (RHSA-2024:2568) vendor-advisory

access.redhat.com/errata/RHSA-2024:2569 (RHSA-2024:2569) vendor-advisory

access.redhat.com/errata/RHSA-2024:2729 (RHSA-2024:2729) vendor-advisory

access.redhat.com/errata/RHSA-2024:2730 (RHSA-2024:2730) vendor-advisory

access.redhat.com/errata/RHSA-2024:2767 (RHSA-2024:2767) vendor-advisory

access.redhat.com/errata/RHSA-2024:3265 (RHSA-2024:3265) vendor-advisory

access.redhat.com/errata/RHSA-2024:3352 (RHSA-2024:3352) vendor-advisory

access.redhat.com/errata/RHSA-2024:4146 (RHSA-2024:4146) vendor-advisory

access.redhat.com/errata/RHSA-2024:4371 (RHSA-2024:4371) vendor-advisory

access.redhat.com/errata/RHSA-2024:4378 (RHSA-2024:4378) vendor-advisory

access.redhat.com/errata/RHSA-2024:4379 (RHSA-2024:4379) vendor-advisory

access.redhat.com/errata/RHSA-2024:4502 (RHSA-2024:4502) vendor-advisory

access.redhat.com/errata/RHSA-2024:4581 (RHSA-2024:4581) vendor-advisory

access.redhat.com/errata/RHSA-2024:4591 (RHSA-2024:4591) vendor-advisory

access.redhat.com/errata/RHSA-2024:4672 (RHSA-2024:4672) vendor-advisory

access.redhat.com/errata/RHSA-2024:4699 (RHSA-2024:4699) vendor-advisory

access.redhat.com/errata/RHSA-2024:4761 (RHSA-2024:4761) vendor-advisory

access.redhat.com/errata/RHSA-2024:4762 (RHSA-2024:4762) vendor-advisory

access.redhat.com/errata/RHSA-2024:4960 (RHSA-2024:4960) vendor-advisory

access.redhat.com/errata/RHSA-2024:5258 (RHSA-2024:5258) vendor-advisory

access.redhat.com/errata/RHSA-2024:5634 (RHSA-2024:5634) vendor-advisory

access.redhat.com/errata/RHSA-2024:7262 (RHSA-2024:7262) vendor-advisory

access.redhat.com/errata/RHSA-2025:7118 (RHSA-2025:7118) vendor-advisory

access.redhat.com/security/cve/CVE-2024-1394 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2262921 (RHBZ#2262921) issue-tracking

github.com/...ommit/85d31d0d257ce842c8a1e63c4d230ae850348136

github.com/...penssl/security/advisories/GHSA-78hx-gp6g-7mj6

github.com/...ommit/104fe7f6912788d2ad44602f77a0a0a62f1f259f

pkg.go.dev/vuln/GO-2024-2660

vuln.go.dev/ID/GO-2024-2660.json

cve.org (CVE-2024-1394)

nvd.nist.gov (CVE-2024-1394)