Description
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.
References (8)
Core 8
Core References
Patch
https://go.dev/cl/501224
Issue Tracking
https://go.dev/issue/60306
Mailing List, Third Party Advisory
https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/
Vendor Advisory
https://pkg.go.dev/vuln/GO-2023-1842
Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/
Third Party Advisory
https://security.gentoo.org/glsa/202311-09
Vendor Advisory
https://security.netapp.com/advisory/ntap-20241206-0003/
Scores
CVSS v3
9.8
EPSS
0.0033
EPSS Percentile
56.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-74
Status
published
Products (2)
fedoraproject/fedora
38
golang/go
< 1.19.10
Published
Jun 08, 2023
Tracked Since
Feb 18, 2026