-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper null handling in message processing. The commit diff shows the original ExtractMessage function returned nil when context was empty, which would cause a nil-pointer dereference when callers tried to access the message. This matches the CWE-476 description and the vulnerability impact statement about crashing via malicious messages. The fix changes error returns to use &msg (an empty struct) instead of nil, confirming this was the vulnerable code path. Other files in the commit show similar patterns but are less directly tied to the UDS Server crash described in the CVE.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/kubeedge/kubeedge | go | = 1.10.0 | 1.10.1 |
| github.com/kubeedge/kubeedge | go | < 1.9.3 | 1.9.3 |