Skip to content
OpenAdvisories
Medium · 6.4 Public exploit CVE-2024-24787 BIT-golang-2024-24787EUVD-2024-22164GHSA-5fq7-4mxc-535hGO-2024-2825

Arbitrary code execution during build on Darwin in cmd/go

Published May 8, 2024 · Updated Feb 13, 2025 · Assigned by Go

Vendor: Go toolchain Product: cmd/go Package: aactl Package: argo-workflows Package: atlantis Package: aws-efs-csi-driver Package: bank-vaults Package: bom Package: boring-registry Package: buildkitd Package: caddy Package: caddy-man Package: cadvisor Package: capslock Package: cert-exporter Package: cert-manager-webhook-pdns Package: certificate-transparency Package: cfssl Package: chartmuseum Package: cilium-cli Package: cloudflared Package: configmap-reload Package: confluent-common-docker Package: conftest Package: cortex Package: cosign Package: crane Package: cri-tools Package: croc Package: crossplane-provider-aws Package: ctop Package: cue Package: dask-gateway Package: delve Package: dex Package: dgraph Package: direnv Package: dive Package: docker-compose Package: docker-credential-acr-env Package: docker-credential-ecr-login Package: docker-credential-gcr Package: dockerize Package: dynamic-localpv-provisioner Package: eksctl Package: extism Package: falcoctl Package: falcosidekick Package: ferretdb Package: flannel Package: flux-image-reflector-controller Package: flux-kustomize-controller Package: flux-notification-controller Package: flux-source-controller Package: flyte Package: frp Package: fulcio Package: fuse-overlayfs-snapshotter Package: ghaudit Package: git-lfs Package: gitleaks Package: gitness Package: gke-gcloud-auth-plugin Package: glab Package: go-1.20 Package: go-1.21 Package: go-1.22 Package: go-bindata Package: go-licenses Package: go-md2man Package: gobump Package: golang Package: golangci-lint Package: gomplate Package: gops Package: gostatsd Package: gosu Package: govulncheck Package: grafana-agent-operator Package: grafana-operator Package: grpcurl Package: guac Package: harbor-cli Package: harbor-registry Package: harbor-scanner-trivy Package: hcloud Package: hello-world-golang Package: helm Package: helm-3 Package: helm-operator Package: helm-push Package: hey Package: http-echo Package: hubble-ui Package: influx Package: ip-masq-agent Package: jitsucom-bulker Package: k3d Package: k8sgpt Package: k9s Package: kaf Package: kafka_exporter Package: katib-earlystopping Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-nas-enas Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: katib-tfevent-metricscollector Package: kind Package: ko Package: kpt Package: ksops Package: kube-bench Package: kube-state-metrics Package: kubebuilder Package: kubecolor Package: kubernetes-csi-driver-hostpath Package: kubernetes-csi-external-provisioner Package: kubernetes-csi-livenessprobe Package: kubernetes-dashboard Package: kubernetes-dashboard-metrics-scraper Package: kubernetes-dns-node-cache Package: kubernetes-ingress-defaultbackend Package: kubescape Package: kubewatch Package: kustomize Package: kwok Package: kwokctl Package: kyverno-policy-reporter-kyverno-plugin Package: kyverno-policy-reporter-ui Package: lazygit Package: libnvidia-container Package: litefs Package: litestream Package: local-path-provisioner Package: local-static-provisioner Package: logstash-exporter Package: mage Package: mc Package: melange Package: metacontroller Package: metrics-server Package: mkcert Package: mockery Package: mods Package: mongo-tools Package: msft-golang Package: multus-cni Package: nats-server Package: neuvector-scanner Package: newrelic-fluent-bit-output-compat Package: newrelic-infra-operator Package: newrelic-nri-statsd Package: newrelic-prometheus-configurator Package: nfs-subdir-external-provisioner Package: nri-prometheus Package: nvidia-container-toolkit Package: oauth2-proxy Package: opa Package: oras Package: osv-scanner Package: overmind Package: paranoia Package: petname Package: php-fpm_exporter Package: policy-controller Package: pombump Package: prometheus-adapter Package: prometheus-alertmanager Package: prometheus-pushgateway Package: pulumi-kubernetes-operator Package: pulumi-language-dotnet Package: pulumi-language-yaml Package: q Package: rabbitmq-default-user-credential-updater Package: rclone Package: redka Package: regclient Package: rekor Package: render-template Package: rootlesskit Package: runc Package: s5cmd Package: scorecard Package: secrets-store-csi-driver Package: secrets-store-csi-driver-provider-aws Package: secrets-store-csi-driver-provider-azure Package: secrets-store-csi-driver-provider-gcp Package: shfmt Package: skaffold Package: skopeo Package: smarter-device-manager Package: snyk-cli Package: sonobuoy Package: sops Package: spark-operator Package: spegel Package: spicedb Package: spqr Package: src Package: src-fingerprint Package: step Package: step-ca Package: stern Package: tekton-chains Package: terraform-docs Package: tfsec Package: thanos Package: timoni Package: toolchain Package: trillian Package: trivy Package: trust-manager Package: vault-k8s Package: vertical-pod-autoscaler Package: volume-modifier-for-k8s Package: vt-cli Package: wait-for-port Package: wave Package: wgcf Package: wire-go Package: wireguard-go Package: zot Ecosystem: Azure Linux Ecosystem: Go Ecosystem: Wolfi

Description

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

Affected products

VendorProductAffectedFixed
Go toolchain cmd/go < 1.21.10, 1.22.0-0 – < 1.22.3 1.21.10

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 go1.21-openssl 1.21.13.1-150600.16.3.1 SUSE-SU-2024:3755-1
SLES 15 SP6 go1.22-openssl 1.22.7.1-150600.13.3.1 SUSE-SU-2024:3938-1
SLES 15 SP5 go1.21 1.21.10-150000.1.33.1 SUSE-SU-2024:1588-1
SLES 15 SP5 go1.21-openssl 1.21.13.1-150000.1.11.1 SUSE-SU-2024:3089-1
SLES 15 SP5 go1.22 1.22.3-150000.1.15.1 SUSE-SU-2024:1587-1
SLES 15 SP5 go1.22-openssl 1.22.7.1-150000.1.3.1 SUSE-SU-2024:3772-1
SLES 15 SP4 go1.21 1.21.10-150000.1.33.1 SUSE-SU-2024:1588-1
SLES 15 SP4 go1.21-openssl 1.21.13.1-150000.1.11.1 SUSE-SU-2024:3089-1
SLES 12 SP5 go1.21 1.21.10-1.33.1 SUSE-SU-2024:1574-1
SLES 12 SP5 go1.22 1.22.3-1.9.1 SUSE-SU-2024:1573-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP4 go1.21 1.21.10-150000.1.33.1 SUSE-SU-2024:1588-1
SLES for SAP 15 SP4 go1.21-openssl 1.21.13.1-150000.1.11.1 SUSE-SU-2024:3089-1
SLE HPC 15 SP4 go1.21 1.21.10-150000.1.33.1 SUSE-SU-2024:1588-1
SLE HPC 15 SP4 go1.21-openssl 1.21.13.1-150000.1.11.1 SUSE-SU-2024:3089-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go1.21 1.21.10-1.1 openSUSE-SU-2024:13941-1
openSUSE Tumbleweed go1.22 1.22.3-1.1 openSUSE-SU-2024:13936-1
openSUSE Leap 15.6 go1.21 1.21.10-150000.1.33.1 SUSE-SU-2024:1588-1
openSUSE Leap 15.6 go1.21-openssl 1.21.13.1-150600.16.3.1 SUSE-SU-2024:3755-1
openSUSE Leap 15.6 go1.22 1.22.3-150000.1.15.1 SUSE-SU-2024:1587-1
openSUSE Leap 15.6 go1.22-openssl 1.22.7.1-150600.13.3.1 SUSE-SU-2024:3938-1
openSUSE Leap 15.5 go1.21 1.21.10-150000.1.33.1 SUSE-SU-2024:1588-1
openSUSE Leap 15.5 go1.21-openssl 1.21.13.1-150000.1.11.1 SUSE-SU-2024:3089-1
openSUSE Leap 15.5 go1.22 1.22.3-150000.1.15.1 SUSE-SU-2024:1587-1
openSUSE Leap 15.5 go1.22-openssl 1.22.7.1-150000.1.3.1 SUSE-SU-2024:3772-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 golang No fix yet —
Azure Linux 2 (CBL-Mariner) msft-golang 1.22.3 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aactl 0.4.12-r12 —
Wolfi rolling argo-workflows 3.6.5-r2 —
Wolfi rolling atlantis 0.27.3-r1 —
Wolfi rolling aws-efs-csi-driver 2.0.2-r1 —
Wolfi rolling bank-vaults 1.20.4-r13 —
Wolfi rolling bom 0.6.0-r5 —
Wolfi rolling boring-registry 0.14.0-r1 —
Wolfi rolling buildkitd 0.13.2-r1 —
Wolfi rolling caddy 2.7.6-r9 —
Wolfi rolling caddy-man 2.7.6-r6 —
Wolfi rolling cadvisor 0.49.1-r7 —
Wolfi rolling capslock 0.2.2-r2 —
Wolfi rolling cert-exporter +1 2.12.0-r5 —
Wolfi rolling cert-manager-webhook-pdns 2.5.1-r3 —
Wolfi rolling certificate-transparency 1.1.8-r3 —
Wolfi rolling cfssl 1.6.5-r4 —
Wolfi rolling chartmuseum 0.16.1-r10 —
Wolfi rolling cilium-cli 0.16.7-r1 —
Wolfi rolling cloudflared 2024.1.0-r10 —
Wolfi rolling configmap-reload 0.13.0-r1 —
Wolfi rolling confluent-common-docker 7.6.0-r5 —
Wolfi rolling conftest 0.52.0-r1 —
Wolfi rolling cortex 1.17.0-r1 —
Wolfi rolling cosign 2.2.4-r4 —
Wolfi rolling crane 0.19.1-r5 —
Wolfi rolling cri-tools 1.30.0-r2 —
Wolfi rolling croc 9.6.15-r1 —
Wolfi rolling crossplane-provider-aws 1.4.0-r1 —
Wolfi rolling ctop 0.7.7-r14 —
Wolfi rolling cue 0.8.2-r1 —
Wolfi rolling dask-gateway 2024.1.0-r4 —
Wolfi rolling delve 1.22.1-r4 —
Wolfi rolling dex 2.39.1-r2 —
Wolfi rolling dgraph 23.1.1-r1 —
Wolfi rolling direnv 2.34.0-r3 —
Wolfi rolling dive 0.12.0-r5 —
Wolfi rolling docker-compose 2.27.0-r1 —
Wolfi rolling docker-credential-acr-env 0.7.0-r12 —
Wolfi rolling docker-credential-ecr-login 0.7.1-r11 —
Wolfi rolling docker-credential-gcr 2.1.22-r5 —
Wolfi rolling dockerize 0.7.0-r8 —
Wolfi rolling dynamic-localpv-provisioner 4.0.0-r3 —
Wolfi rolling eksctl 0.176.0-r1 —
Wolfi rolling extism 1.4.0-r0 —
Wolfi rolling falcoctl 0.7.3-r9 —
Wolfi rolling falcosidekick 2.28.0-r6 —
Wolfi rolling ferretdb 1.21.0-r3 —
Wolfi rolling flannel 0.25.1-r2 —
Wolfi rolling flux-image-reflector-controller 0.32.0-r1 —
Wolfi rolling flux-source-controller +2 1.3.0-r1 —
Wolfi rolling flyte 1.12.0-r1 —
Wolfi rolling frp 0.58.0-r1 —
Wolfi rolling fulcio 1.4.5-r2 —
Wolfi rolling fuse-overlayfs-snapshotter 1.0.8-r9 —
Wolfi rolling ghaudit 0.4.0-r3 —
Wolfi rolling git-lfs 3.5.1-r4 —
Wolfi rolling gitleaks 8.18.2-r3 —
Wolfi rolling gitness 3.0.0_beta6-r3 —
Wolfi rolling gke-gcloud-auth-plugin 0.0.2-r10 —
Wolfi rolling glab 1.40.0-r1 —
Wolfi rolling go-1.20 No fix yet —
Wolfi rolling go-1.21 1.21.10-r0 —
Wolfi rolling go-1.22 1.22.3-r0 —
Wolfi rolling go-bindata 3.1.3-r19 —
Wolfi rolling go-licenses 1.6.0-r13 —
Wolfi rolling go-md2man 2.0.4-r3 —
Wolfi rolling gobump 0.7.7-r2 —
Wolfi rolling golangci-lint 1.58.1-r0 —
Wolfi rolling gomplate 3.11.7-r5 —
Wolfi rolling gops 0.3.28-r10 —
Wolfi rolling gostatsd 28.3.0-r2 —
Wolfi rolling gosu 1.17-r5 —
Wolfi rolling govulncheck 1.0.2-r4 —
Wolfi rolling grafana-agent-operator 0.40.4-r2 —
Wolfi rolling grafana-operator 5.9.0-r1 —
Wolfi rolling grpcurl 1.9.1-r3 —
Wolfi rolling guac 0.6.0-r1 —
Wolfi rolling harbor-cli 0.0.1-r2 —
Wolfi rolling harbor-registry 3.0.0_alpha1-r3 —
Wolfi rolling harbor-scanner-trivy 0.31.1-r1 —
Wolfi rolling hcloud 1.43.1-r1 —
Wolfi rolling hello-world-golang 1.3-r3 —
Wolfi rolling helm 3.14.4-r3 —
Wolfi rolling helm-3 3.19.2-r1 —
Wolfi rolling helm-operator 1.34.1-r5 —
Wolfi rolling helm-push 0.10.4-r10 —
Wolfi rolling hey 0.1.4-r13 —
Wolfi rolling hubble-ui 0.13.0-r9 —
Wolfi rolling influx 2.7.5-r1 —
Wolfi rolling ip-masq-agent 2.9.3-r11 —
Wolfi rolling k3d 5.6.3-r2 —
Wolfi rolling k8sgpt 0.3.30-r1 —
Wolfi rolling k9s 0.32.4-r4 —
Wolfi rolling kaf 0.2.8-r3 —
Wolfi rolling kafka_exporter 1.7.0-r3 —
Wolfi rolling katib-earlystopping +8 0.19.0-r31 —
Wolfi rolling katib-suggestion-goptuna-compat 0.19.0-r40 —
Wolfi rolling kind 0.22.0-r4 —
Wolfi rolling ko 0.15.2-r9 —
Wolfi rolling kpt 1.0.0_beta49-r6 —
Wolfi rolling ksops 4.3.1-r1 —
Wolfi rolling kube-bench 0.7.3-r2 —
Wolfi rolling kube-state-metrics 2.12.0-r3 —
Wolfi rolling kubebuilder 3.14.2-r1 —
Wolfi rolling kubecolor 0.3.2-r1 —
Wolfi rolling kubernetes-csi-driver-hostpath 1.13.0-r4 —
Wolfi rolling kubernetes-csi-external-provisioner 4.0.1-r2 —
Wolfi rolling kubernetes-dashboard 2.7.0-r18 —
Wolfi rolling kubernetes-dashboard-metrics-scraper 1.0.9-r16 —
Wolfi rolling kubernetes-dns-node-cache 1.23.0-r6 —
Wolfi rolling kubernetes-ingress-defaultbackend 1.29.1-r0 —
Wolfi rolling kubescape 3.0.10-r1 —
Wolfi rolling kubewatch +1 2.6.0-r1 —
Wolfi rolling kustomize 5.4.1-r4 —
Wolfi rolling kwok +1 0.5.2-r2 —
Wolfi rolling kyverno-policy-reporter-kyverno-plugin 1.6.3-r5 —
Wolfi rolling kyverno-policy-reporter-ui 1.9.2-r6 —
Wolfi rolling lazygit 0.42.0-r0 —
Wolfi rolling libnvidia-container +1 1.15.0-r1 —
Wolfi rolling litefs 0.5.11-r5 —
Wolfi rolling litestream 0.3.13-r2 —
Wolfi rolling local-path-provisioner 0.0.27-r0 —
Wolfi rolling local-static-provisioner 2.7.0-r2 —
Wolfi rolling logstash-exporter 1.6.4-r1 —
Wolfi rolling mage 1.15.0-r7 —
Wolfi rolling mc 0.20231220.071422-r8 —
Wolfi rolling melange 0.6.11-r5 —
Wolfi rolling metacontroller 4.11.12-r0 —
Wolfi rolling metrics-server 0.7.1-r3 —
Wolfi rolling mkcert 1.4.4-r2 —
Wolfi rolling mockery 2.43.0-r1 —
Wolfi rolling mods 1.3.1-r1 —
Wolfi rolling mongo-tools 100.9.4-r4 —
Wolfi rolling multus-cni 4.0.2-r3 —
Wolfi rolling nats-server 2.10.14-r1 —
Wolfi rolling neuvector-scanner 0_git20240417-r2 —
Wolfi rolling newrelic-fluent-bit-output-compat 2.4.0-r5 —
Wolfi rolling newrelic-infra-operator 0.18.0-r5 —
Wolfi rolling newrelic-nri-statsd 2.9.1-r3 —
Wolfi rolling newrelic-prometheus-configurator 1.16.0-r1 —
Wolfi rolling nfs-subdir-external-provisioner 4.0.18-r7 —
Wolfi rolling nri-prometheus 2.21.1-r1 —
Wolfi rolling oauth2-proxy 7.6.0-r7 —
Wolfi rolling opa 0.64.1-r1 —
Wolfi rolling oras 1.1.0-r7 —
Wolfi rolling osv-scanner 1.7.3-r0 —
Wolfi rolling overmind 2.5.1-r1 —
Wolfi rolling paranoia 0.2.1-r14 —
Wolfi rolling petname 2.11-r7 —
Wolfi rolling php-fpm_exporter 2.2.0-r4 —
Wolfi rolling policy-controller 0.9.0-r2 —
Wolfi rolling pombump 0.0.12-r2 —
Wolfi rolling prometheus-adapter 0.11.2-r8 —
Wolfi rolling prometheus-alertmanager 0.27.0-r5 —
Wolfi rolling prometheus-pushgateway 1.8.0-r2 —
Wolfi rolling pulumi-language-dotnet 3.63.1-r1 —
Wolfi rolling pulumi-language-yaml 1.7.0-r1 —
Wolfi rolling q 0.19.2-r5 —
Wolfi rolling rabbitmq-default-user-credential-updater 1.0.4-r1 —
Wolfi rolling rclone 1.66.0-r3 —
Wolfi rolling redka 0.4.0-r1 —
Wolfi rolling regclient 0.6.0-r4 —
Wolfi rolling rekor 1.3.6-r3 —
Wolfi rolling render-template 1.0.6-r4 —
Wolfi rolling rootlesskit 2.1.0-r1 —
Wolfi rolling runc 1.1.12-r6 —
Wolfi rolling s5cmd 2.2.2-r3 —
Wolfi rolling scorecard 4.13.1-r8 —
Wolfi rolling secrets-store-csi-driver 1.4.3-r1 —
Wolfi rolling secrets-store-csi-driver-provider-aws 0.3.8-r3 —
Wolfi rolling secrets-store-csi-driver-provider-azure 1.5.2-r1 —
Wolfi rolling secrets-store-csi-driver-provider-gcp 1.5.0-r5 —
Wolfi rolling shfmt 3.8.0-r3 —
Wolfi rolling skaffold 2.11.1-r3 —
Wolfi rolling skopeo +1 1.15.0-r4 —
Wolfi rolling smarter-device-manager 1.20.11-r7 —
Wolfi rolling snyk-cli 1.1291.0-r1 —
Wolfi rolling sonobuoy 0.57.1-r6 —
Wolfi rolling sops 3.8.1-r7 —
Wolfi rolling spark-operator 1.2.15-r0 —
Wolfi rolling spegel 0.0.22-r1 —
Wolfi rolling spicedb 1.32.0-r1 —
Wolfi rolling spqr 1.3.0-r3 —
Wolfi rolling src 5.3.0-r5 —
Wolfi rolling src-fingerprint 0.19.0-r13 —
Wolfi rolling step +1 0.26.1-r1 —
Wolfi rolling stern 1.29.0-r1 —
Wolfi rolling tekton-chains 0.20.1-r5 —
Wolfi rolling terraform-docs 0.17.0-r5 —
Wolfi rolling tfsec 1.28.6-r1 —
Wolfi rolling thanos 0.35.0-r1 —
Wolfi rolling timoni 0.21.0-r1 —
Wolfi rolling trillian 1.6.0-r5 —
Wolfi rolling trivy 0.51.1-r1 —
Wolfi rolling trust-manager 0.9.2-r3 —
Wolfi rolling vault-k8s 1.4.1-r1 —
Wolfi rolling vertical-pod-autoscaler 1.1.1-r2 —
Wolfi rolling volume-modifier-for-k8s 0.2.1-r5 —
Wolfi rolling vt-cli +1 1.0.0-r6 —
Wolfi rolling wait-for-port 1.0.7-r4 —
Wolfi rolling wave 0.8.0-r1 —
Wolfi rolling wgcf 2.2.22-r1 —
Wolfi rolling wire-go 0.6.0-r3 —
Wolfi rolling wireguard-go 0.0.20230223-r11 —
Wolfi rolling zot 2.0.4-r1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Go toolchain < 1.21.10 · >= 1.22.0-0, < 1.22.3 1.21.10, 1.22.3 GO-2024-2825

Advisories 11

References