CVE-2022-24684: Nomad Spread Job Stanza May Trigger Panic in Servers
6.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.70434%
CWE
Published
2/16/2022
Updated
2/3/2023
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/hashicorp/nomad | go | >= 0.9.0, < 1.0.18 | 1.0.18 |
| github.com/hashicorp/nomad | go | >= 1.1.0, < 1.1.12 | 1.1.12 |
| github.com/hashicorp/nomad | go | >= 1.2.0, < 1.2.6 | 1.2.6 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from improper state management in the spread iterator when processing job updates. The key functions are:
- SetJob() - Failed to reset internal maps (tgSpreadInfo/groupPropertySets) when switching job versions, allowing stale spread configuration data to persist
- Next() - Attempted to access spreadDetails without nil checking, causing panic when processing jobs that removed spread configurations
These functions would appear in stack traces when:
- Processing job updates with spread->no-spread configuration changes
- Handling allocation stops while maintaining canary deployments
- Accessing uninitialized spreadAttributeMap entries during node ranking
The added map resets in SetJob and nil checks in Next() directly correspond to the vulnerability's root cause (CWE-400) by preventing resource exhaustion through panic-induced server crashes.