CVE-2024-24787 — Toolchain CMD GO vulnerability

6 documents6 sources
Severity
6.4MEDIUMNVD
EPSS
2.7%
top 14.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
GO Toolchain CMD GO
Timeline
PublishedMay 8
Latest updateMay 14

Description

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.5 | Impact: 5.9

Affected Packages1 packages

▶CVEListV5go_toolchain/cmd_go1.22.0-0 — 1.22.3+1

🔴Vulnerability Details

3
CVEList
Arbitrary code execution during build on Darwin in cmd/go↗2024-05-08
▶
GHSA
GHSA-5fq7-4mxc-535h: On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_l↗2024-05-08
▶
OSV
Arbitrary code execution during build on Darwin in cmd/go↗2024-05-08
▶

📋Vendor Advisories

2
Microsoft
Arbitrary code execution during build on Darwin in cmd/go↗2024-05-14
▶
Debian
CVE-2024-24787: golang-1.15 - On Darwin, building a Go module which contains CGO can trigger arbitrary code ex...↗2024
▶
CVE-2024-24787 — GO Toolchain CMD GO vulnerability | cvebase