BudgetScan

Fragile SO_REUSEPORT detection based on error-text substring match

low swesweep-fasthttp · reuseport/reuseport.go · Listen · run #4

Description

Listen() classifies failures as ErrNoReusePort solely by checking whether err.Error() contains the literal string "SO_REUSEPORT". Because network and addr are caller-supplied, an attacker-controlled configuration value can include the substring in an address or otherwise influence the generated error text. This can cause an unrelated bind/listen failure to be reported as missing SO_REUSEPORT support, potentially misleading callers that branch on ErrNoReusePort. The impact is limited to incorrect error handling or fallback behavior; there is no direct memory corruption, payload parsing, or buffer overflow in this file.

Triage

Not triaged.

Raw scan report for this file

```json
[
  {
    "severity": "low",
    "title": "Fragile SO_REUSEPORT detection based on error-text substring match",
    "function": "Listen",
    "description": "Listen() classifies failures as ErrNoReusePort solely by checking whether err.Error() contains the literal string \"SO_REUSEPORT\". Because network and addr are caller-supplied, an attacker-controlled configuration value can include the substring in an address or otherwise influence the generated error text. This can cause an unrelated bind/listen failure to be reported as missing SO_REUSEPORT support, potentially misleading callers that branch on ErrNoReusePort. The impact is limited to incorrect error handling or fallback behavior; there is no direct memory corruption, payload parsing, or buffer overflow in this file."
  }
]
```