Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an…
Priority LOW 26CWE-404Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 11 fixed, 23 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-404.
Summary
Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.
Why it matters now
EPSS 0.01997 80th percentileScored 2026-11-07
Fix Partial Red Hat: 15 advisoriesRed Hat: 11 fixed, 23 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.16.12; 1.17.0 to before 1.17.5 | Vulnerable | Go standard library |
| cpe:2.3:o:opengroup:unix:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Opengroup |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.16.12; 1.17.0 to before 1.17.5 Vulnerable ·Go standard library
- cpe:2.3:o:opengroup:unix:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Opengroup
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
Remediation
Red Hat 15 advisories
- RHSA-2023:0408 Released 2023-01-25 · Red Hat rating ImportantOpenShift Virtualization 4.12.0 Images security update
- CNV 4.12 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-provisioner-rhel8, container-native-virtualization/hostpath-provisioner-rhel8-operator +9
- RHSA-2023:0407 Released 2023-01-24 · Red Hat rating ModerateOpenShift Virtualization 4.12.0 RPMs security update
- CNV 4.12 for RHEL 7 kubevirt-4.12.0-1057.el7, kubevirt-virtctl-4.12.0-1057.el7, kubevirt-virtctl-redistributable-4.12.0-1057.el7
- CNV 4.12 for RHEL 8 kubevirt-4.12.0-1057.el8, kubevirt-virtctl-4.12.0-1057.el8, kubevirt-virtctl-redistributable-4.12.0-1057.el8
- RHSA-2022:6526 Released 2022-09-14 · Red Hat rating ImportantOpenShift Virtualization 4.11.0 Images security and bug fix update
- CNV 4.11 for RHEL 8 container-native-virtualization/checkup-framework, container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8 +11
Show 12 more Red Hat advisories
- RHSA-2022:1734 Released 2022-05-05 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.1 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-velero-rhel8
- RHSA-2022:1372 Released 2022-04-13 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.10.0 enhancement, security & bug fix update
- RHODF 4.10 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-operator-bundle +21
- RHSA-2022:1361 Released 2022-04-13 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.10.0 RPM security,enhancement&bugfix update
- RHODF 4.10 for RHEL 8 mcg-5.10.0-72.el8, mcg-redistributable-5.10.0-72.el8
- RHSA-2022:1056 Released 2022-03-24 · Red Hat rating ModerateRelease of OpenShift Serverless Client kn 1.21.0
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.0.0-2.el8
- RHSA-2022:1051 Released 2022-03-24 · Red Hat rating ModerateRelease of OpenShift Serverless 1.21.0
- Red Hat OpenShift Serverless 1.21 openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8, openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8 +31
- RHSA-2022:0927 Released 2022-03-21 · Red Hat rating ModerateOpenShift Container Platform 4.10.5 packages and security update
- Red Hat OpenShift Container Platform 4.10 containernetworking-plugins-0.9.1-2.rhaos4.10.el8, runc-3:1.1.0-2.rhaos4.10.el8
- RHSA-2022:0947 Released 2022-03-16 · Red Hat rating ModerateOpenShift Virtualization 4.10.0 Images security and bug fix update
- CNV 4.10 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8
- RHSA-2022:0056 Released 2022-03-10 · Red Hat rating ModerateOpenShift Container Platform 4.10.3 security update
- Red Hat OpenShift Container Platform 4.10 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
- RHSA-2022:0055 Released 2022-03-10 · Red Hat rating ModerateOpenShift Container Platform 4.10.3 bug fix and security update
- Red Hat OpenShift Container Platform 4.10 coreos-installer-0.12.0-1.rhaos4.10.el8, coreos-installer-bootinfra-0.12.0-1.rhaos4.10.el8, cri-o-1.23.0-92.rhaos4.10.gitdaab4d1.el7 +11
- RHSA-2022:0557 Released 2022-02-23 · Red Hat rating ModerateOpenShift Container Platform 4.9.22 security update
- Red Hat OpenShift Container Platform 4.9 butane-0.13.1-2.rhaos4.9.el8, butane-redistributable-0.13.1-2.rhaos4.9.el8, cri-o-1.22.1-17.rhaos4.9.git3029b1d.2.el8 +14
- RHSA-2021:5176 Released 2021-12-16 · Red Hat rating Importantgo-toolset-1.16 and go-toolset-1.16-golang security and bug fix update
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.16-1.16.12-1.el7_9, go-toolset-1.16-build-1.16.12-1.el7_9, go-toolset-1.16-golang-1.16.12-1.el7_9 +8
- RHSA-2021:5160 Released 2021-12-15 · Red Hat rating Importantgo-toolset:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.6.0-1.module+el8.5.0+10379+d6b83bd0.src::go-toolset:rhel8, delve-1.6.0-1.module+el8.5.0+10379+d6b83bd0.x86_64::go-toolset:rhel8, go-toolset-1.16.12-1.module+el8.5.0+13637+960c7771.aarch64::go-toolset:rhel8 +18
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Containers | Affected | No fix planned: Will not fix |
| OpenShift Serverless | Affected | No fix yet |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| OpenShift Service Mesh 2.1 | Affected | No fix yet |
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 4 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 5 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 2 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix yet |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 16.1 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Service Telemetry Framework 1.2 for RHEL 8 | Affected | No fix planned: Will not fix |
| Service Telemetry Framework 1.3 for RHEL 8 | Affected | No fix planned: Will not fix |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2022:1734 |
| CNV 4.12 for RHEL 7 | Fixed | RHSA-2023:0407 |
| CNV 4.12 for RHEL 8 | Fixed | RHSA-2023:0407, RHSA-2023:0408 |
| CNV 4.9 for RHEL 8 | Fixed | — |
| RHODF 4.10 for RHEL 8 | Fixed | RHSA-2022:1361, RHSA-2022:1372 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2021:5176 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:5160 |
| Red Hat OpenShift Container Platform 4.10 | Fixed | RHSA-2022:0055, RHSA-2022:0056, RHSA-2022:0927 |
| Red Hat OpenShift Container Platform 4.9 | Fixed | RHSA-2022:0557 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2022:1056 |
| Red Hat OpenShift Serverless 1.21 | Fixed | RHSA-2022:1051 |
Not affected: 10 products
- 8Base-RHMTC-1.7
- CNV 4.12 for RHEL 8
- CNV 4.9 for RHEL 8
- Red Hat Advanced Cluster Security 3
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4.10
- Red Hat OpenShift Container Platform 4.9
- Red Hat OpenShift distributed tracing 2
- Red Hat OpenStack Platform 16.1
Timeline
- 2026-10-02 Threatist record created from CVE-2021-44717
- 2026-10-03 Alias added: GHSA-x9r7-cjm2-h6cp
References
Advisory 3
Sources
- CVE-2021-44717 · CVE Program
- CVE-2021-44717 · NVD
- FIRST EPSS
- GHSA-x9r7-cjm2-h6cp · GitHub Advisory Database · CC BY 4.0
- CVE-2021-44717 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences