Arbitrary code execution during build via line directives in cmd/go
CVE-2023-39323

9.8CRITICAL

Key Information:

Vendor

Go Toolchain

Status
Cmd/go
Vendor
CVE Published:
5 October 2023

What is CVE-2023-39323?

A vulnerability in the Go compiler permits the use of line directives ('//line') to circumvent restrictions on '//go:cgo_' directives. This exploitation can inadvertently allow blocked linker and compiler flags to be executed during the 'go build' process, potentially leading to arbitrary code execution. While the complexity of this vulnerability is heightened due to the requirement for the absolute file path of the directive, developers should remain vigilant and apply necessary updates promptly to safeguard their applications.

Affected Version(s)

cmd/go 0 < 1.20.9

cmd/go 1.21.0-0 < 1.21.2

References

https://go.dev/issue/63211
https://go.dev/cl/533215
https://groups.google.com/g/golang-announce/c/XBa1oHDevAo

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.