Description

The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.

Classification

CVE ID: CVE-2023-29405

CVSS Base Severity: LOW

CVSS Base Score: 0.0

Affected Products

Vendor: Go toolchain

Product: cmd/go

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.93% (probability of being exploited)

EPSS Percentile: 82.97% (scored less or equal to compared to others)

EPSS Date: 2025-02-03 (when was this score calculated)

References

https://go.dev/issue/60306
https://go.dev/cl/501224
https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
https://pkg.go.dev/vuln/GO-2023-1842
https://lists.fedoraproject.org/archives/list/[email protected]/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/
https://lists.fedoraproject.org/archives/list/[email protected]/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/
https://security.gentoo.org/glsa/202311-09

Timeline