crypto/internal/fips140: CVE-2022-29526 reported in golang.org/x/sys

[CameronGo]

I believe CVE-2022-29526 is already fixed in the current go version, however, when you download and extract the current Go v1.24.0, this CVE is reported due to the version of golang.org/x/sys reported in /usr/local/go/src/crypto/internal/fips140/bigmod/_asm/go.mod and /usr/local/go/src/crypto/internal/fips140/edwards25519/field/_asm/go.mod, which appears as follows:

go 1.19

require github.com/mmcloughlin/avo v0.4.0

require (
        golang.org/x/mod v0.4.2 // indirect
        golang.org/x/sys v0.0.0-20211030160813-b3129d9d1021 // indirect
        golang.org/x/tools v0.1.7 // indirect
        golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
)

It looks as though someone tried to submit a PR to fix some time ago, but nothing happened with it. #62452

[ianlancetaylor]

In case it's not clear, there is no actual vulnerability here. The code you are describing is only used to generate other files in the standard library, it is not itself part of the standard library.

CC @golang/security @golang/release

[gabyhelp]

Related Issues

• fix(sec): upgrade golang.org/x/sys to 0.1.0 #62452 (closed)
• x/pkgsite: Versions tab showing fixed vulnerabilities for version-tagged x/ repos #56357 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}