golang-fips OpenSSL RSA bindings: memory leak on error paths allows remote resource exhaustion

Impact

Go programs built against the Red Hat golang-fips OpenSSL bindings leak the pkey and ctx objects on every RSA init/property-setting error, because the deferred cleanup runs with nil named return values. An attacker who can feed malformed inputs to an RSA encrypt/decrypt path drives unbounded memory growth until the process is OOM-killed. This matters wherever a FIPS-mode Go service terminates TLS or handles RSA on datacenter infrastructure - registries, control-plane APIs, operators - all of which are Go and all of which ship on RHEL in many fleets. Availability only; no confidentiality or integrity impact.

Who can reach it

Remote, unauthenticated, for any service that processes attacker-supplied input through the affected RSA code path in a FIPS-enabled Go build.

What to do

Apply the Red Hat errata for the affected golang / go-toolset packages and rebuild or re-pull any Go binaries built against them, then restart the services. Patching the base image is not enough: statically linked Go services must be rebuilt or replaced with vendor-rebuilt images.

References

Related entries

• Xen (x86 speculation): Incorrect logic for BTC/SRSO mitigationsCVE-2024-31142 · Xen (x86 speculation)High
• AMD CPU (EntrySign): Improper signature verification in the AMD CPU microcode patch loaderCVE-2024-36347 · AMD CPU (EntrySign)High
• VMware vCenter: Privilege escalation to root on vCenter via a crafted network packetCVE-2024-38813 · VMware vCenterHigh
• Linux kernel NVMe target core (controller teardown racing queue-pair establishment): An initiator that disconnectsCVE-2024-42152 · Linux kernel NVMe target core (controller teardown racing queue-pair establishment)High
• Linux kernel NVMe-oF TCP target (nvmet-tcp queue command allocation failure): When command allocation for a new queueCVE-2024-46737 · Linux kernel NVMe-oF TCP target (nvmet-tcp queue command allocation failure)High
• Linux kernel SMC (CLC message drain loop, unchecked sock_recvmsg return): The length field in the CLC header isCVE-2024-57791 · Linux kernel SMC (CLC message drain loop, unchecked sock_recvmsg return)High