x/vulndb: potential Go vuln in github.com/etcd-io/etcd: CVE-2022-34038

[GoVulnBot]

CVE-2022-34038 references github.com/etcd-io/etcd, which may be a Go module.

Description:
Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2022-34038
• JSON: https://github.com/CVEProject/cvelist/tree/62ab537d070a2a3f96e8fd27d3e754204f5d5fef/2022/34xxx/CVE-2022-34038.json
• fix: fix(pkg/ioutil):avoid panic in PageWriter.Write() when pageBytes is 0 etcd-io/etcd#14022
• fix: add a verification on the pagebytes which must be > 0 etcd-io/etcd#14452
• Imported by: https://pkg.go.dev/github.com/etcd-io/etcd?tab=importedby

Cross references:

• Module github.com/etcd-io/etcd appears in issue x/vulndb: potential Go vuln in github.com/etcd-io/etcd: CVE-2021-28235 #1689 EFFECTIVELY_PRIVATE
• Module github.com/etcd-io/etcd appears in issue x/vulndb: potential Go vuln in github.com/etcd-io/etcd: CVE-2023-32082 #1771 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/etcd-io/etcd
      vulnerable_at: 2.3.8+incompatible
      packages:
        - package: n/a
description: |-
    Etcd v3.5.4 allows remote attackers to cause a denial of service via function
    PageWriter.write in pagewriter.go
cves:
    - CVE-2022-34038
references:
    - fix: https://github.com/etcd-io/etcd/pull/14022
    - fix: https://github.com/etcd-io/etcd/pull/14452

[gopherbot]

Change https://go.dev/cl/522555 mentions this issue: data/excluded: batch add 11 excluded reports

[ahrtr]

The only way to trigger this CVE is to dynamically change an unexported variable's value at runtime.

I am curious how can it be done?

[serathius]

This is some big misunderstanding. Yes, there is a function in etcd util packages called NewpageWriter. Yes, you can pass pageBytes negative argument, it will cause this function to panic. However, this argument is set based on const, not user configurable, neigher remotely.

There is no way to exploit this. Also etcd-io/etcd#14452 is not a proper fix, it adds validation that will also panic, but will provide a nice error.

[maceonthompson]

Thanks for pointing this out! It would have been excluded from the database either way, but we'll update the reason to be "not a vuln"

[gopherbot]

Change https://go.dev/cl/524456 mentions this issue: data/excluded: update GO-2023-2016.yaml