OpenTelemetry Go concurrent map race condition causing DoS vulnerability

Vulnerability Overview Vulnerability Name: Unsynchronized baggage map can panic under concurrent access Description: The type in the package introduces an unsynchronized map. A goroutine can write to this map via , while another goroutine reads and iterates over the map. This can lead to a Go concurrent map access panic, causing the process to crash. The severity is rated as low because exploitation requires specific OpenTelemetry bridging configuration and concurrent usage of the same span. Affected Versions Affected Versions: Fixed Versions: Remediation Fixed Versions: Proof of Concept (POC) Code Technical Details Commit Introducing the Vulnerability: Vulnerable Code Path: adds to without using a mutex or other synchronization primitives. Trigger Conditions: - shows that calls , which creates the map and writes to without locking. - shows that reads from , checks , and iterates over without locking. - shows that calls , allowing the read path to run concurrently with the baggage map write path. Exploitation: Since Go maps are not thread-safe for concurrent read/write access, concurrent calls to and on the same instance can terminate the process with a runtime error such as or . Impact This is a race condition/incorrect synchronization vulnerability involving a shared Go map. Applications using the OpenTelemetry OpenTracing bridge may crash if the same is accessed concurrently, with one execution path setting baggage and another propagating correlated baggage. The practical impact is a Denial of Service (DoS) for affected applications. Exposure depends on whether the application's request handling or internal concurrency triggers these operations on the same span. Additional Information CVSS v4 Base Metrics: - Severity: Medium (5.9 / 10) - Attack Vector: Local - Attack Complexity: Low - Attack Requirements: Present - Privileges Required: None - User Interaction: None - Vulnerable System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: High - Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None CVE ID: CVE-2024-45404 Weaknesses: - CWE-362 - CWE-667 Credits: - Reporter: pellared - Analyst: MAtias

Goal Reached Thanks to every supporter — we hit 100%!

OpenTelemetry Go concurrent map race condition causing DoS vulnerability

More from this source