CVE-2022-30634 is a high-severity vulnerability that affects systems running certain versions of the Go programming language on Windows, as well as systems running NetApp Cloud Insights Telegraf Agent. This vulnerability involves an infinite loop in the Read function of the crypto/rand package, which can cause an indefinite hang when a buffer larger than 1 << 32 - 1 bytes is passed. To address this issue, users should update their Go installations to versions 1.17.11 or 1.18.3.

How do I know if I'm affected?

If you're using the Go programming language on Windows, you might be affected by the vulnerability. This issue occurs in versions before 1.17.11 and from 1.18.0 up to (excluding) 1.18.3. It involves an infinite loop in the crypto/rand package, which can cause an indefinite hang when a buffer larger than 1 << 32 - 1 bytes is passed. To check if you're affected, review your Go installation and ensure it's not within the mentioned vulnerable versions.

What should I do if I'm affected?

If you're affected by the vulnerability, update your Go installation to version 1.17.11 or 1.18.3, which includes security fixes. To do this, visit the Go download page, select the appropriate version for your system, and follow the installation instructions. This will help protect your system from the indefinite hang issue caused by the vulnerability.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2022-30634 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This vulnerability, named "Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows," was added on July 15, 2022. There is no due date mentioned, but users are advised to update their Go installations to address the issue and protect their systems from potential hangs caused by the vulnerability.

Weakness enumeration

The vulnerability is related to an infinite loop issue in the crypto/rand package, identified as CWE-835, which can cause indefinite hangs on affected systems.

For more details

CVE-2022-30634 is a high-severity vulnerability affecting certain Go programming language versions on Windows and NetApp Cloud Insights Telegraf Agent. The issue involves an infinite loop in the crypto/rand package, causing indefinite hangs on affected systems. For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the links below.

• Patch for the vulnerability

• Exploit and issue tracking

• Mailing list and patch

• Mailing list and third-party advisory

• Third-party advisory