CVE-2022-41716 - CVE House

Back to Database

Status published Unknown CVE-2022-41716

Unsanitized NUL in environment variables on Windows in syscall and os/exec

0 CVSS

Vulnerability Description

Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-41716

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

RyotaK (https://twitter.com/ryotkak)

References

More from Go standard library

View All →

Unexpected session resumption in crypto/tls

Handshake messages may be processed at the incorrect encryption level in crypto/tls

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

Excessive CPU consumption when building archive index in archive/zip

Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

Affected Vendor

Go standard library

View all reports →

Affected Software

syscall, os/exec

Vulnerable Versions:

0, 1.19.0-0

Timeline

Official Publish: November 2nd, 2022

Last Modified: October 30th, 2024

Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.