CVE-2024-24790: 
cAdvisor vulnerability analysis and mitigation

CVE-2024-24790 is a vulnerability discovered in the Go language standard library's net/netip package. The issue affects the various Is methods (IsPrivate, IsLoopback, etc) which did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. The vulnerability was reported by Enze Wang of Alioth (@zer0yu) and Jianjun Chen of Zhongguancun Lab (@chenjj) (Golang Announce).

The vulnerability has been assigned a CVSS 3.1 base score of 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue specifically affects Go versions prior to 1.21.11 and versions from 1.22.0-0 before 1.22.4. The vulnerability impacts several methods in the net/netip package including Addr.IsGlobalUnicast, Addr.IsInterfaceLocalMulticast, Addr.IsLinkLocalMulticast, Addr.IsLoopback, Addr.IsMulticast, and Addr.IsPrivate (Go Vuln).

When successfully exploited, this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). The critical CVSS score indicates high impact potential across confidentiality, integrity, and availability (Ubuntu CVE).

The issue has been fixed in Go versions 1.21.11 and 1.22.4. Users are advised to upgrade to these versions or later to address the vulnerability. The fix has been implemented through patches that correct the behavior of Is methods for IPv4-mapped IPv6 addresses (Golang Announce).