Vulnerability Report: GO-2024-2825
- CVE-2024-24787
- Affects: cmd/go
- Published: May 08, 2024
- Modified: May 20, 2024
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.
Affected Packages
-
PathVersionsSymbols
-
before go1.21.10, from go1.22.0-0 before go1.22.3all symbols
Aliases
References
- https://go.dev/issue/67119
- https://go.dev/cl/583815
- https://groups.google.com/g/golang-announce/c/wkkO4P9stm0
- https://vuln.go.dev/ID/GO-2024-2825.json
Credits
- Juho Forsén (Mattermost)
Feedback
See anything missing or incorrect?
Suggest an edit to this report.