Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment.
Priority LOW 29CWE-269Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 12 fixed, 10 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-269.
Summary
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.
Why it matters now
EPSS 0.02951 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial golang.org/x/sys (Go): 0.0.0-20220412211240-33da011f77adRed Hat: 12 advisoriesRed Hat: 12 fixed, 10 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | golang.org/x/sys (Go) | before 0.0.0-20220412211240-33da011f77ad | 0.0.0-20220412211240-33da011f77ad | Patch available | GHSA-p782-xgp4-8hr8 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- golang.org/x/sys (Go) Vendor— Affected before 0.0.0-20220412211240-33da011f77ad Fixed in 0.0.0-20220412211240-33da011f77ad Patch available GHSA-p782-xgp4-8hr8
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.17.10; 1.18.0 to before 1.18.2 | Vulnerable | Go standard library |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:a:netapp:beegfs_csi_driver:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.17.10; 1.18.0 to before 1.18.2 Vulnerable ·Go standard library
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:a:netapp:beegfs_csi_driver:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · GHSA-p782-xgp4-8hr8 golang.org/x/sys (Go) Fixed in 0.0.0-20220412211240-33da011f77ad Advisory →
Red Hat 12 advisories
- RHSA-2023:3642 Released 2023-06-15 · Red Hat rating ImportantRed Hat Ceph Storage 6.1 Container security and bug fix update
- Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3
- RHSA-2023:1529 Released 2023-03-30 · Red Hat rating ModerateService Telemetry Framework 1.5 security update
- Service Telemetry Framework 1.5 for RHEL 8 stf/sg-core-rhel8
- RHSA-2023:0408 Released 2023-01-25 · Red Hat rating ImportantOpenShift Virtualization 4.12.0 Images security update
- CNV 4.12 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-provisioner-rhel8, container-native-virtualization/hostpath-provisioner-rhel8-operator +9
Show 9 more Red Hat advisories
- RHSA-2022:6714 Released 2022-09-26 · Red Hat rating ModerateRHACS 3.72 enhancement and security update
- RHACS 3.72 for RHEL 8 advanced-cluster-security/rhacs-docs-rhel8, advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-rhel8-operator +3
- RHSA-2022:6277 Released 2022-08-31 · Red Hat rating ModerateRed Hat OpenShift Service Mesh 2.1.5 security update
- OpenShift Service Mesh 2.1 servicemesh-2.1.5-1.el8, servicemesh-cni-2.1.5-1.el8, servicemesh-operator-2.1.5-1.el8 +6
- RHSA-2022:6156 Released 2022-08-24 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.11.0 security, enhancement, & bugfix update
- RHODF 4.11 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-rhel8-operator +12
- RHSA-2022:5840 Released 2022-08-02 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.3 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-registry-rhel8 +7
- RHSA-2022:5799 Released 2022-08-01 · Red Hat rating Importantgo-toolset and golang security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.17.12-1.el9_0, golang-1.17.12-1.el9_0, golang-bin-1.17.12-1.el9_0 +5
- RHSA-2022:5729 Released 2022-08-01 · Red Hat rating ModerateOpenShift Container Platform 4.10.25 security update
- Red Hat OpenShift Container Platform 4.10 atomic-openshift-service-idler-4.10.0-202207192015.p0.g39cfc66.assembly.stream.el8, cri-o-1.23.3-11.rhaos4.10.gitddf4b1a.1.el7, cri-o-1.23.3-11.rhaos4.10.gitddf4b1a.1.el8 +10
- RHSA-2022:5699 Released 2022-07-28 · Red Hat rating ModerateSecondary Scheduler Operator for Red Hat OpenShift 1.0.1 security update
- OSSO 1.0 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
- RHSA-2022:5337 Released 2022-06-30 · Red Hat rating Moderatego-toolset:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.10-1.module+el8.6.0+15486+6d4da7db.aarch64::go-toolset:rhel8 +18
- RHSA-2022:5201 Released 2022-06-27 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.4.5 security updates and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Developer Tools and Services | Affected | No fix planned: Will not fix |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Ceph Storage 5 | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Service Telemetry Framework 1.4 for RHEL 8 | Affected | No fix planned: Will not fix |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2022:5840 |
| CNV 4.12 for RHEL 8 | Fixed | RHSA-2023:0408 |
| OSSO 1.0 for RHEL 8 | Fixed | RHSA-2022:5699 |
| OpenShift Service Mesh 2.1 | Fixed | RHSA-2022:6277 |
| RHACS 3.72 for RHEL 8 | Fixed | RHSA-2022:6714 |
| RHODF 4.11 for RHEL 8 | Fixed | RHSA-2022:6156 |
| Red Hat Ceph Storage 6.1 Tools | Fixed | RHSA-2023:3642 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:5337 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:5799 |
| Red Hat OpenShift Container Platform 4.10 | Fixed | RHSA-2022:5729 |
| Red Hat OpenShift Container Platform 4.11 | Fixed | — |
| Service Telemetry Framework 1.5 for RHEL 8 | Fixed | RHSA-2023:1529 |
Not affected: 10 products
- 8Base-RHMTC-1.7
- CNV 4.12 for RHEL 8
- OSSO 1.0 for RHEL 8
- OpenShift Service Mesh 2.1
- RHACS 3.72 for RHEL 8
- RHODF 4.11 for RHEL 8
- Red Hat Ceph Storage 6.1 Tools
- Red Hat Enterprise Linux 7
- Red Hat OpenShift Container Platform 4.10
- Service Telemetry Framework 1.5 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2022-29526
- 2026-10-03 Alias added: GHSA-p782-xgp4-8hr8
References
Advisory 9
- https://groups.google.com/g/golang-announce
- https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdU
- FEDORA-2022-fae3ecee19
- FEDORA-2022-ffe7dba2cb
- FEDORA-2022-ba365d3703
- https://security.netapp.com/advisory/ntap-20220729-0001/
- GLSA-202208-02
- FEDORA-2022-30c5ed5625
- https://nvd.nist.gov/vuln/detail/CVE-2022-29526
Other 10
- https://github.com/golang/go
- https://go.dev/cl/399539
- https://go.dev/cl/400074
- https://go.dev/issue/52313
- https://lists.fedoraproject.org/archives/list/[email protected]/message/Q6GE5EQGE4L2KRVGW4T75QVIYAXCLO5X
- https://lists.fedoraproject.org/archives/list/[email protected]/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6
- https://lists.fedoraproject.org/archives/list/[email protected]/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR
- https://pkg.go.dev/vuln/GO-2022-0493
- https://security.netapp.com/advisory/ntap-20220729-0001
Sources
- CVE-2022-29526 · CVE Program
- CVE-2022-29526 · NVD
- FIRST EPSS
- GHSA-p782-xgp4-8hr8 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-29526 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences