Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go
CVE-2023-29405

9.8CRITICAL

Key Information:

Vendor

Go Toolchain

Status
Cmd/go
Cmd/cgo
Vendor
CVE Published:
8 June 2023

What is CVE-2023-29405?

The Go programming language's cgo feature may be exploited to execute arbitrary code at build time. This vulnerability arises when users run "go get" on a malicious module or execute other commands that compile untrusted code. The issue is linked to the mishandling of linker flags specified through the "#cgo LDFLAGS" directive, specifically when flags containing embedded spaces allows unauthorized flags to be injected, bypassing sanitization. The vulnerability predominantly impacts users of the gccgo compiler.

Affected Version(s)

cmd/cgo 0 < 1.19.10

cmd/cgo 1.20.0-0 < 1.20.5

cmd/go 0 < 1.19.10

References

https://go.dev/issue/60306
https://go.dev/cl/501224
https://groups.google.com/g/golang-announce/c/q5135a9d924...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Juho Nurminen of Mattermost
.