VYPR
← All advisories
Moderate severityNVD Advisory· Published Jun 22, 2022· Updated Aug 3, 2024

CVE-2022-29526

CVE-2022-29526

Description

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Incorrect privilege assignment in Go's Faccessat function could incorrectly report file accessibility with non-zero flags.

Vulnerability

CVE-2022-29526 describes an incorrect privilege assignment in Go's Faccessat function. When called with a non-zero flags parameter, the function may incorrectly report that a file is accessible, even when the calling process does not have the necessary permissions [2]. This issue affects Go versions before 1.17.10 and 1.18.x before 1.18.2.

Exploitation

The flaw can be triggered by passing a non-zero value for the flags argument to Faccessat. An attacker with the ability to invoke this system call could cause the function to return a false positive regarding file accessibility, potentially bypassing intended access controls.

Impact

Successful exploitation could allow an attacker to gain unauthorized access to files or escalate privileges, as the incorrect permission check may let them read or write files they should not be able to access [3].

Mitigation

The Go team has fixed this issue in Go 1.17.10 and Go 1.18.2. Users are advised to update to these releases or later to remediate the vulnerability.

References
  1. NVD - CVE-2022-29526
  2. GO-2022-0493 - Go Packages

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
golang.org/x/sysGo
< 0.0.0-20220412211240-33da011f77ad0.0.0-20220412211240-33da011f77ad

Affected products

79

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

20

News mentions

0

No linked articles in our index yet.