CVE-2022-41716 json
Unsanitized NUL in environment variables on Windows in syscall and os/exec
published 2022-11-01 4 y ago modified 2026-09-08 2 mo ago also BIT-golang-2022-41716 , EUVD-2022-44892 , GO-2022-1095
- cvss
- 6.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".
Patch / fix
- bitnami golang 1.18.8, 1.19.3
- go stdlib 1.18.8, 1.19.3
- Go standard library syscall 1.18.8, 1.19.3
- Go standard library os/exec 1.18.8, 1.19.3
- golang-1.19 Debian 12 1.19.3-1
debian advisories DEBIAN-CVE-2022-41716
- go1.18-openssl SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +6 more 1.18.10.1-150000.1.9.1
- go1.18 SLE Module for Development Tools 15 SP4, SLE Module for Development Tools 15 SP3, openSUSE Leap 15.4 +1 more 1.18.8-150000.1.37.1
- go1.19 SLE Module for Development Tools 15 SP4, SLE Module for Development Tools 15 SP3, openSUSE Leap 15.4 +1 more 1.19.3-150000.1.15.1
suse advisories SUSE-SU-2023:2312-1SUSE-SU-2022:4055-1SUSE-SU-2022:4054-1
- go1.18 openSUSE Tumbleweed 1.18.8-1.1
- go1.19 openSUSE Tumbleweed 1.19.3-1.1
opensuse advisories openSUSE-SU-2024:12471-1openSUSE-SU-2024:12472-1
- go.dev/issue/56284 advisory
- go.dev/cl/446916 advisory
- groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJ advisory
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.03% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | golang | <1.18.8 >=1.19.0, <1.19.3 |
1.18.8 1.19.3 |
| go | stdlib | <1.18.8 >=1.19.0-0, <1.19.3 |
1.18.8 1.19.3 |
Affected products
- Go standard library syscall
- Go standard library os/exec
References
-
go.dev
/issue/56284
issue-tracking, patch, vendor-advisory, advisory, report
-
go.dev
/cl/446916
patch, vendor-advisory, advisory
-
groups.google.com
/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJ
patch, release-notes, vendor-advisory, advisory, web
-
pkg.go.dev
/vuln/GO-2022-1095
vendor-advisory, advisory
-
security.netapp.com
/advisory/ntap-20230120-0007/
web
-
nvd.nist.gov
/vuln/detail/CVE-2022-41716
web
Sources
- CVE List CVE-2022-41716
- NVD CVE-2022-41716
- OSV BIT-golang-2022-41716
- OSV GO-2022-1095
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.