Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads

Summary

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey​ and ctx​. That function uses named return parameters to free pkey​ and ctx​ if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey​ and ctx​ will be nil inside the deferred function that should free them.

Timeline

1. Mar 21, 2024, 12:16 PM UTCCVE published
2. Mar 21, 2024, 6:21 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 29, 2026, 6:16 AM UTCRecord last updated

Affected versions

• receptor

  Version range not reported

• receptor

  Version range not reported

• go-toolset-1.19-golang

  Version range not reported

• go-toolset:rhel8

  Version range not reported

• grafana-pcp

  Version range not reported

• grafana

  Version range not reported

• container-tools:rhel8

  Version range not reported

• osbuild-composer

  Version range not reported

• golang

  Version range not reported

• grafana

  Version range not reported

• grafana-pcp

  Version range not reported

• buildah

  Version range not reported

• podman

  Version range not reported

• gvisor-tap-vsock

  Version range not reported

• skopeo

  Version range not reported

• containernetworking-plugins

  Version range not reported

• runc

  Version range not reported

• osbuild-composer

  Version range not reported

• podman

  Version range not reported

• containernetworking-plugins

  Version range not reported

• golang

  Version range not reported

• podman

  Version range not reported

• buildah

  Version range not reported

• butane

  Version range not reported

• containernetworking-plugins

  Version range not reported

• cri-o

  Version range not reported

• cri-tools

  Version range not reported

• ignition

  Version range not reported

• openshift-clients

  Version range not reported

• podman

  Version range not reported

• runc

  Version range not reported

• skopeo

  Version range not reported

• buildah

  Version range not reported

• containernetworking-plugins

  Version range not reported

• cri-o

  Version range not reported

• cri-tools

  Version range not reported

• ignition

  Version range not reported

• openshift-clients

  Version range not reported

• podman

  Version range not reported

• runc

  Version range not reported

• skopeo

  Version range not reported

• butane

  Version range not reported

• containernetworking-plugins

  Version range not reported

• cri-o

  Version range not reported

• cri-tools

  Version range not reported

• ignition

  Version range not reported

• openshift-clients

  Version range not reported

• ose-aws-ecr-image-credential-provider

  Version range not reported

• podman

  Version range not reported

• skopeo

  Version range not reported

• buildah

  Version range not reported

• conmon

  Version range not reported

• openshift

  Version range not reported

• openshift4-aws-iso

  Version range not reported

• openshift-ansible

  Version range not reported

• openshift-kuryr

  Version range not reported

• runc

  Version range not reported

• microshift

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• buildah

  Version range not reported

• butane

  Version range not reported

• containernetworking-plugins

  Version range not reported

• cri-o

  Version range not reported

• cri-tools

  Version range not reported

• ignition

  Version range not reported

• openshift-clients

  Version range not reported

• ose-aws-ecr-image-credential-provider

  Version range not reported

• podman

  Version range not reported

• runc

  Version range not reported

• skopeo

  Version range not reported

• microshift

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• etcd

  Version range not reported

• collectd-sensubility

  Version range not reported

• etcd

  Version range not reported

• collectd-sensubility

  Version range not reported

• odf4/mcg-operator-bundle

  Version range not reported

• odf4/mcg-rhel9-operator

  Version range not reported

• tang-operator-bundle-container

  Version range not reported

• helm

  Version range not reported

• odo

  Version range not reported

• openshift-pipelines-client

  Version range not reported

• openshift-serverless-clients

  Version range not reported

• helm

  Version range not reported

• openshift-clients

  Version range not reported

• redhat-certification-preflight

  Version range not reported

• redhat-certification-preflight

  Version range not reported

• buildah

  Version range not reported

• containernetworking-plugins

  Version range not reported

• host-metering

  Version range not reported

• podman

  Version range not reported

• rhc-worker-script

  Version range not reported

• skopeo

  Version range not reported

• container-tools:4.0/buildah

  Version range not reported

• container-tools:4.0/conmon

  Version range not reported

• container-tools:4.0/containernetworking-plugins

  Version range not reported

• container-tools:4.0/podman

  Version range not reported

• container-tools:4.0/runc

  Version range not reported

• container-tools:4.0/skopeo

  Version range not reported

• container-tools:4.0/toolbox

  Version range not reported

• git-lfs

  Version range not reported

• rhc

  Version range not reported

• weldr-client

  Version range not reported

• butane

  Version range not reported

• conmon

  Version range not reported

• git-lfs

  Version range not reported

• ignition

  Version range not reported

• toolbox

  Version range not reported

• weldr-client

  Version range not reported

• conmon-rs

  Version range not reported

• golang-github-prometheus-promu

  Version range not reported

• lifecycle-agent-operator-bundle-container

  Version range not reported

• openshift4/bare-metal-event-relay-operator-bundle

  Version range not reported

• openshift4/numaresources-operator-bundle

  Version range not reported

• openshift4/ose-cluster-machine-approver

  Version range not reported

• mcg

  Version range not reported

• devspaces/machineexec-rhel8

  Version range not reported

• openshift-gitops-1/gitops-operator-bundle

  Version range not reported

• rosa

  Version range not reported

• kubevirt

  Version range not reported

• etcd

  Version range not reported

• golang-qpid-apache

  Version range not reported

• qpid-proton

  Version range not reported

• golang-github-infrawatch-apputils

  Version range not reported

• golang-qpid-apache

  Version range not reported

• qpid-proton

  Version range not reported

• golang-qpid-apache

  Version range not reported

• qpid-proton

  Version range not reported

• etcd

  Version range not reported

• qpid-proton

  Version range not reported

• skupper-cli

  Version range not reported

• skupper-router

  Version range not reported

• rh-git227-git-lfs

  Version range not reported

• heketi

  Version range not reported

• github.com/golang-fips/goGo

  through 1.22.1

• github.com/golang-fips/openssl/v2Go

  fixed in 2.0.1

• github.com/microsoft/go-crypto-opensslGo

  through 0.2.8

• github.com/microsoft/go-crypto-openssl/opensslGo

  fixed in 0.2.9

• github.com/microsoft/go-crypto-opensslGo

  fixed in 0.2.9

References 25