CVE-2023-29404 Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go

2023-06-0820:19:17

www.cve.org

cve-2023-29404; improper handling; go command; cgo; arbitrary code; build time; "go get"; malicious module; untrusted code; ldflags directive; linker flags; gc compiler; gccgo compiler; security vulnerability

9.9 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

77.3%

JSON

The go command may execute arbitrary code at build time when using cgo. This may occur when running “go get” on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a “#cgo LDFLAGS” directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers.

CNA Affected

[
  {
    "vendor": "Go toolchain",
    "product": "cmd/go",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "cmd/go",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.19.10",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.20.0-0",
        "lessThan": "1.20.5",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]