Fragile SO_REUSEPORT detection based on error-text substring match
low swesweep-fasthttp · reuseport/reuseport.go · Listen · run #4
Description
Listen() classifies failures as ErrNoReusePort solely by checking whether err.Error() contains the literal string "SO_REUSEPORT". Because network and addr are caller-supplied, an attacker-controlled configuration value can include the substring in an address or otherwise influence the generated error text. This can cause an unrelated bind/listen failure to be reported as missing SO_REUSEPORT support, potentially misleading callers that branch on ErrNoReusePort. The impact is limited to incorrect error handling or fallback behavior; there is no direct memory corruption, payload parsing, or buffer overflow in this file.
Triage
Not triaged.
Raw scan report for this file
```json
[
{
"severity": "low",
"title": "Fragile SO_REUSEPORT detection based on error-text substring match",
"function": "Listen",
"description": "Listen() classifies failures as ErrNoReusePort solely by checking whether err.Error() contains the literal string \"SO_REUSEPORT\". Because network and addr are caller-supplied, an attacker-controlled configuration value can include the substring in an address or otherwise influence the generated error text. This can cause an unrelated bind/listen failure to be reported as missing SO_REUSEPORT support, potentially misleading callers that branch on ErrNoReusePort. The impact is limited to incorrect error handling or fallback behavior; there is no direct memory corruption, payload parsing, or buffer overflow in this file."
}
]
```