CVE-2024-24787 Arbitrary code execution during build on Darwin in cmd/go

2024-05-0815:31:14

github.com

cve-2024-24787

arbitrary code execution

darwin

cmd/go

apple version of ld

cgo

#cgo ldflags

-lto_library flag

6.9 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.4%

JSON

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a “#cgo LDFLAGS” directive.

CNA Affected

[
  {
    "vendor": "Go toolchain",
    "product": "cmd/go",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.21.10",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "1.22.0-0",
        "lessThan": "1.22.3",
        "versionType": "semver"
      }
    ],
    "platforms": [
      "darwin"
    ],
    "packageName": "cmd/go",
    "collectionURL": "https://pkg.go.dev",
    "defaultStatus": "unaffected"
  }
]