CVE-2023-29405: Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go
Golang Go could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when running "go get" on a malicious module. By sending a specially crafted request using linker flags, an attacker could exploit this vulnerability to execute arbitrary code on the system.
Other sources
Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go
— Microsoft
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.
https://go.dev/issue/60306 https://pkg.go.dev/vuln/GO-2023-1842 https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ https://go.dev/cl/501224
— Red Hat
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-29405?
CVE-2023-29405 is a vulnerability in the go command that allows for the execution of arbitrary code at build time when using cgo.
How does CVE-2023-29405 occur?
CVE-2023-29405 can occur when running "go get" on a malicious module or any other command that builds untrusted code, triggered by linker flags specified via a "#cgo LDFLAGS" directive.
Which software versions are affected by CVE-2023-29405?
Versions of the go command up to version 1.19.10, versions 1.20.0 to 1.20.5, and Fedora version 38 are affected by CVE-2023-29405.
What is the severity of CVE-2023-29405?
CVE-2023-29405 has a severity rating of 9.8, which is considered critical.
How can I fix CVE-2023-29405?
To fix CVE-2023-29405, it is recommended to update to a version of the go command that is not affected by the vulnerability.