title: Unsanitized NUL in environment variables on Windows in syscall and os/exec
description: Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".
problem types: CWE-158: Improper Neutralization of Null Byte or NUL Character
affected:
{
vendor: Go standard library
product: syscall
collectionURL: https://pkg.go.dev
packageName: syscall
versions:
version: 0, lessThan: 1.18.8, status: affected, versionType: semver
version: 1.19.0-0, lessThan: 1.19.3, status: affected, versionType: semver
platforms: windows
programRoutines:
name: StartProcess
defaultStatus: unaffected
}
{
vendor: Go standard library
product: os/exec
collectionURL: https://pkg.go.dev
packageName: os/exec
versions:
version: 0, lessThan: 1.18.8, status: affected, versionType: semver
version: 1.19.0-0, lessThan: 1.19.3, status: affected, versionType: semver
platforms: windows
programRoutines:
name: Cmd.environ
name: dedupEnv
name: dedupEnvCase
name: Cmd.CombinedOutput
name: Cmd.Environ
name: Cmd.Output
name: Cmd.Run
name: Cmd.Start
defaultStatus: unaffected
}
