CVE-2024-24787

MEDIUM

Arbitrary code execution during build on Darwin in cmd/go

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-24787 has a selected CVSS score of 6.4 (medium); EIP currently links 1 repository PoC.

Description

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 5, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

cmd/go

Browse Go toolchain / cmd/go

Default status: unaffected

CVE ListBefore 1.21.10affected
1.22.0-0 to < 1.22.3affected

go

Browse golang / go

Default status: affected

CVE List1.21.0affected
1.22affected

Proofs of concept

1

Repository PoCs

GitHubLOURC0D3/CVE-2024-24787-PoCRepository PoCby LOURC0D35Not analyzed6 files

322.9 KiB

GitHub
PoC details

References

7