title: Indefinite hang with large buffers on Windows in crypto/rand
description: Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.
problem types: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
affected:
{
vendor: Go standard library
product: crypto/rand
collectionURL: https://pkg.go.dev
packageName: crypto/rand
versions:
version: 0, lessThan: 1.17.11, status: affected, versionType: semver
version: 1.18.0-0, lessThan: 1.18.3, status: affected, versionType: semver
platforms: windows
programRoutines:
name: Read
defaultStatus: unaffected
}