Skip to content
OpenAdvisories
Critical · 9.8 CVE-2023-29404 BIT-golang-2023-29404EUVD-2023-32975GHSA-888h-rm2r-vrc7GO-2023-1841

Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go

Published Jun 8, 2023 · Updated Jan 6, 2025 · Assigned by Go

Vendor: Go toolchain Product: cmd/go Package: go Package: golang Package: golang-1.10 Package: golang-1.13 Package: golang-1.14 Package: golang-1.16 Package: golang-1.17 Package: golang-1.18 Package: golang-1.19 Package: golang-1.20 Package: golang-1.6 Package: golang-1.8 Package: golang-1.9 Package: katib-earlystopping Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-nas-enas Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: katib-tfevent-metricscollector Package: kind Package: msft-golang Package: policy-controller Package: toolchain Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers.

Affected products

VendorProductAffectedFixed
Go toolchain cmd/go < 1.19.10, 1.20.0-0 – < 1.20.5 1.19.10

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 12 golang-1.19 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS golang-1.17 1.17.13-3ubuntu1.2 USN-7061-1
Ubuntu 22.04 LTS golang-1.18 1.18.1-1ubuntu1.2 USN-7109-1
Ubuntu 22.04 LTS golang-1.20 No fix yet —
Ubuntu 20.04 LTS golang-1.13 +2 No fix yet —
Ubuntu 20.04 LTS golang-1.18 1.18.1-1ubuntu1~20.04.3 USN-7109-1
Ubuntu 18.04 LTS golang-1.8 +2 No fix yet —
Ubuntu 16.04 LTS golang-1.6 +1 No fix yet —
Ubuntu 14.04 LTS golang-1.10 No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS golang-1.13 No fix yet —
Ubuntu Pro 20.04 LTS golang-1.16 No fix yet —
Ubuntu Pro 18.04 LTS golang-1.13 +1 No fix yet —
Ubuntu Pro 18.04 LTS golang-1.18 1.18.1-1ubuntu1~18.04.4+esm1 USN-7109-1
Ubuntu Pro 16.04 LTS golang-1.13 No fix yet —
Ubuntu Pro 16.04 LTS golang-1.18 1.18.1-1ubuntu1~16.04.6+esm1 USN-7109-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 golang +7 1.19.10-1.el9_2 RHSA-2023:3923
RHEL 8 delve 1.9.1-1.module+el8.8.0+16778+5fbb74f5 RHSA-2023:3922
RHEL 8 golang +7 1.19.10-1.module+el8.8.0+19203+782922b7 RHSA-2023:3922
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Devtools 2023 go-toolset-1.19 +10 1.19.10-1.el7_9 RHSA-2023:3920

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 golang +7 1.19.10-1.el9_2 ALSA-2023:3923
AlmaLinux 8 delve 1.9.1-1.module_el8.8.0+3471+a62632a0 ALSA-2023:3922
AlmaLinux 8 golang +7 1.19.10-1.module_el8.8.0+3571+89db2ae0 ALSA-2023:3922

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 golang +1 1.19.10-1.el9_2 RLSA-2023:3923

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 go1.19 1.19.10-150000.1.34.1 SUSE-SU-2023:2525-1
SLES 15 SP5 go1.20 1.20.5-150000.1.14.1 SUSE-SU-2023:2526-1
SLES 15 SP4 go1.19 1.19.10-150000.1.34.1 SUSE-SU-2023:2525-1
SLES 15 SP4 go1.20 1.20.5-150000.1.14.1 SUSE-SU-2023:2526-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Real Time 15 SP3 go1.19 1.19.10-150000.1.34.1 SUSE-SU-2023:2525-1
SLE Real Time 15 SP3 go1.20 1.20.5-150000.1.14.1 SUSE-SU-2023:2526-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go1.19 1.19.10-1.1 openSUSE-SU-2024:12987-1
openSUSE Tumbleweed go1.20 1.20.5-1.1 openSUSE-SU-2024:12988-1
openSUSE Leap 15.5 go1.19 1.19.10-150000.1.34.1 SUSE-SU-2023:2525-1
openSUSE Leap 15.5 go1.20 1.20.5-150000.1.14.1 SUSE-SU-2023:2526-1
openSUSE Leap 15.4 go1.19 1.19.10-150000.1.34.1 SUSE-SU-2023:2525-1
openSUSE Leap 15.4 go1.20 1.20.5-150000.1.14.1 SUSE-SU-2023:2526-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 go 1.20.5-r0 —
Alpine v3.23 go 1.20.5-r0 —
Alpine v3.22 go 1.20.5-r0 —
Alpine v3.21 go 1.20.5-r0 —
Alpine v3.20 go 1.20.5-r0 —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 go 1.20.5-r0 —
Alpine v3.18 go 1.20.5-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 golang +6 1.20.5-1.amzn2023.0.2 ALAS2023-2023-269
Amazon Linux 2 golang +6 1.20.5-1.amzn2.0.2 ALAS2-2023-2163

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 golang 1.22.7-2 —
Azure Linux 2 (CBL-Mariner) golang 1.20.7-1 —
Azure Linux 2 (CBL-Mariner) msft-golang 1.19.10-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 golang +7 1.19.10-1.0.1.el9_2 ELSA-2023-3923
Oracle Linux 8 delve 1.9.1-1.0.1.module+el8.8.0+20964+30a27755 ELSA-2023-3922
Oracle Linux 8 go-toolset 1.19.10-1.module+el8.8.0+21109+b7104c00 ELSA-2023-3922
Oracle Linux 8 golang +6 1.19.10-1.0.1.module+el8.8.0+21109+b7104c00 ELSA-2023-3922

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling katib-earlystopping +8 0.19.0-r31 —
Wolfi rolling katib-suggestion-goptuna-compat 0.19.0-r40 —
Wolfi rolling kind 0.21.0-r0 —
Wolfi rolling policy-controller 0.7.0-r4 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go toolchain < 1.19.10 · >= 1.20.0-0, < 1.20.5 1.19.10, 1.20.5 GO-2023-1841

Advisories 22

References