Skip to content
OpenAdvisories
Unscored Public exploit CVE-2018-6574 EUVD-2018-18324GHSA-c37c-qq99-c897GO-2022-0201

Remote command execution via "go get" command with cgo in cmd/go

Published Feb 7, 2018 · Updated Aug 5, 2024 · Assigned by mitre

Package: go Package: go1.10 Package: golang-1.6 Package: golang-1.8 Package: toolchain Ecosystem: Alpine Ecosystem: Go Ecosystem: Ubuntu

Description

Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 9 golang-1.8 1.8.1-1+deb9u1 DSA-4380-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS golang-1.8 No fix yet —
Ubuntu 16.04 LTS golang-1.6 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 golang +5 1.9.4-1.el7 RHSA-2018:0878
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Devtools 2018 go-toolset-7 +3 1.8-14.el7 RHSA-2018:1304
Red Hat Devtools 2018 go-toolset-7-golang +6 1.8.7-2.el7 RHSA-2018:1304

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE Package Hub 12 go 1.9.4-15.1 openSUSE-SU-2018:0589-1, openSUSE-SU-2018:0588-1
SUSE Package Hub 12 go1.8 1.8.7-5.1 openSUSE-SU-2018:0629-1, openSUSE-SU-2018:0628-1
SUSE Package Hub 12 go1.9 1.9.4-5.1 openSUSE-SU-2018:0589-1, openSUSE-SU-2018:0588-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go 1.17-1.1 openSUSE-SU-2024:10802-1
openSUSE Tumbleweed go1.10 1.10.8-8.2 openSUSE-SU-2024:10803-1
openSUSE Tumbleweed go1.11 1.11.13-10.5 openSUSE-SU-2024:10804-1
openSUSE Tumbleweed go1.12 1.12.17-4.8 openSUSE-SU-2024:10805-1
openSUSE Tumbleweed go1.9 1.9.7-11.2 openSUSE-SU-2024:10812-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 go 1.9.4-r0 —
Alpine v3.23 go 1.9.4-r0 —
Alpine v3.22 go 1.9.4-r0 —
Alpine v3.21 go 1.9.4-r0 —
Alpine v3.20 go 1.9.4-r0 —
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 go 1.9.4-r0 —
Alpine v3.18 go 1.9.4-r0 —
Alpine v3.17 go 1.9.4-r0 —
Alpine v3.16 go 1.9.4-r0 —
Alpine v3.15 go 1.9.4-r0 —
Alpine v3.14 go 1.9.4-r0 —
Alpine v3.13 go 1.9.4-r0 —
Alpine v3.12 go 1.9.4-r0 —
Alpine v3.11 go 1.9.4-r0 —
Alpine v3.10 go 1.9.4-r0 —
Alpine v3.9 go 1.9.4-r0 —
Alpine v3.8 go 1.9.4-r0 —
Alpine v3.7 go +1 1.9.4-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 golang +5 1.9.4-1.amzn2 ALAS2-2018-1011

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 91 repositories · most starred shown

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Go toolchain < 1.8.7 · >= 1.9.0-0, < 1.9.4 1.8.7, 1.9.4 GO-2022-0201

Advisories 13

References