CVE-2024-24788

Description

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

CVSS Metrics

• v3.1•MEDIUM•Score: 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 1.00%• Percentile: 61%

Techniques & Countermeasures

• CWE-835•Loop with Unreachable Exit Condition ('Infinite Loop')

  The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Systems

• chainguard•aactl

  < 0.4.12-r12

• chainguard•actions-runner-controller-fips

  < 0.9.1-r1

• chainguard•actions-runner-controller-fips-compat

  < 0.9.1-r1

• chainguard•addon-resizer-fips

  < 1.8.21-r0

• chainguard•addon-resizer-fips-compat

  < 1.8.21-r0

• chainguard•argo-workflows-fips

  < 3.5.6-r2

• chainguard•atlantis

  < 0.27.3-r1

• chainguard•atlantis-fips

  < 0.27.3-r1

• chainguard•aws-ebs-csi-driver

  < 1.30.0-r1

• chainguard•aws-efs-csi-driver

  < 2.0.2-r1

• chainguard•aws-efs-csi-driver-fips

  < 1.7.0-r10

• chainguard•aws-flb-cloudwatch-compat-fips

  < 1.9.4-r3

• chainguard•aws-flb-cloudwatch-fips

  < 1.9.4-r3

• chainguard•aws-flb-firehose-compat-fips

  < 1.7.2-r3

• chainguard•aws-flb-firehose-fips

  < 1.7.2-r3

• chainguard•aws-flb-kinesis-compat-fips

  < 1.10.2-r4

• chainguard•aws-flb-kinesis-fips

  < 1.10.2-r4

• chainguard•aws-load-balancer-controller-fips

  < 2.7.2-r4

• chainguard•azure-aad-pod-identity-mic

  < 1.8.17-r9

• chainguard•azure-aad-pod-identity-nmi

  < 1.8.17-r9

• chainguard•bank-vaults

  < 1.20.4-r13

• chainguard•bank-vaults-fips

  < 1.20.4-r10

• chainguard•bank-vaults-template-fips

  < 1.20.4-r10

• chainguard•bom

  < 0.6.0-r5

• chainguard•boring-registry

  < 0.14.0-r1

• chainguard•boring-registry-fips

  < 0.14.0-r1

• chainguard•buildkitd

  < 0.13.2-r1

• chainguard•caddy

  < 2.7.6-r9

• chainguard•caddy-fips

  < 2.7.6-r6

• chainguard•cadvisor

  < 0.49.1-r7

• chainguard•cadvisor-fips

  < 0.49.1-r6

• chainguard•capslock

  < 0.2.2-r2

• chainguard•cass-operator-compat-fips

  < 1.20.0-r1

• chainguard•cass-operator-fips

  < 1.20.0-r1

• chainguard•cass-operator-fips-no-pvc-delete

  < 1.20.0-r1

• chainguard•cass-operator-fips-no-pvc-delete-compat

  < 1.20.0-r1

• chainguard•cert-exporter

  < 2.12.0-r5

• chainguard•cert-exporter-fips

  < 2.12.0-r6

• chainguard•cert-manager-webhook-pdns

  < 2.5.1-r3

• chainguard•cert-manager-webhook-pdns-fips

  < 2.5.1-r4

• chainguard•certificate-transparency

  < 1.1.8-r3

• chainguard•certificate-transparency-fips

  < 1.1.8-r4

• chainguard•certificate-transparency-fips-trillian-ctserver

  < 1.1.8-r4

• chainguard•cfssl

  < 1.6.5-r4

• chainguard•chainctl

  < 0.2.59-r0

• chainguard•chartmuseum

  < 0.16.1-r10

• chainguard•cilium-cli

  < 0.16.7-r1

• chainguard•cilium-fips-1.15

  < 1.15.4-r2

• chainguard•cilium-fips-1.15-clustermesh-apiserver

  < 1.15.4-r2

• chainguard•cilium-fips-1.15-container-init

  < 1.15.4-r2

Showing first 50 affected entries in server-rendered view.

References (22)

• https://go.dev/issue/66754
• https://go.dev/cl/578375
• https://groups.google.com/g/golang-announce/c/wkkO4P9stm0
• https://pkg.go.dev/vuln/GO-2024-2824
• http://www.openwall.com/lists/oss-security/2024/05/08/3
• https://security.netapp.com/advisory/ntap-20240605-0002/
• https://security.netapp.com/advisory/ntap-20240614-0001/
• https://security-tracker.debian.org/tracker/CVE-2024-24788
• https://access.redhat.com/errata/RHBA-2024:3840
• https://issues.redhat.com/browse/RHEL-35630
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhba-2024_3840.json
• https://access.redhat.com/security/cve/CVE-2024-24788
• https://bugzilla.redhat.com/show_bug.cgi?id=2279814
• https://www.cve.org/CVERecord?id=CVE-2024-24788
• https://nvd.nist.gov/vuln/detail/CVE-2024-24788
• https://access.redhat.com/errata/RHSA-2024:9200
• https://issues.redhat.com/browse/RHEL-46380
• https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index
• https://access.redhat.com/security/updates/classification/#moderate
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9200.json
• https://access.redhat.com/errata/RHSA-2024:9277
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9277.json