CVE-2024-24787

2024-05-0816:15:08

[email protected]

web.nvd.nist.gov

darwin

go module

cgo

arbitrary code execution

apple

lto library

6.9 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.4%

JSON

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a “#cgo LDFLAGS” directive.

CNA Affected

[
  {
    "vendor": "Go toolchain",
    "product": "cmd/go",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "cmd/go",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.21.10",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.22.0-0",
        "lessThan": "1.22.3",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "platforms": [
      "darwin"
    ],
    "defaultStatus": "unaffected"
  }
]