Vulnerability in Golang Go
CVE-2023-29405
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.017 (76.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 76th percentile — 76.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.017 · newest: 0.017 · change: 0.000
Affected products
- Golang Go
- Go Toolchain Cmd/cgo — versions 0, 1.20.0-0
- Go Toolchain Cmd/go — versions 0, 1.20.0-0
- Fedoraproject Fedora — versions 38
Weakness classification (CWE)
Public proof-of-concept exploits
References
- go.dev/issue/60306 (Issue Tracking)
- go.dev/cl/501224 (Patch)
- groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ (Mailing List, Third Party Advisory)
- pkg.go.dev/vuln/GO-2023-1842 (Vendor Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (Mailing List)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/…
- security.gentoo.org/glsa/202311-09
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2023-29405?
- CVE-2023-29405 is a critical-severity vulnerability in Golang Go, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 9.8/10. Published 2023-06-08.
- How severe is CVE-2023-29405?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2023-29405 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.