Vulnerability · Published Oct 5, 2023 · Assigned by Go
CVE-2023-39323Arbitrary code execution during build via line directives in cmd/go
High 8.1
In plain English
A high-severity security flaw in cmd/go from Go toolchain. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | go | 1.21.2-r0 | ALPINE-CVE-2023-39323 |
| Alpine:v3.21 | go | 1.21.2-r0 | ALPINE-CVE-2023-39323 |
| Alpine:v3.22 | go | 1.21.2-r0 | ALPINE-CVE-2023-39323 |
| Alpine:v3.23 | go | 1.21.2-r0 | ALPINE-CVE-2023-39323 |
| Alpine:v3.24 | go | 1.21.2-r0 | ALPINE-CVE-2023-39323 |
| Debian:12 | golang-1.19 | no fix listed | DEBIAN-CVE-2023-39323 |
| Go | toolchain | 1.20.9, 1.21.2 | GO-2023-2095 |
| Ubuntu:22.04:LTS | golang-1.17 | 1.17.13-3ubuntu1.3 | USN-7111-1 |
| Ubuntu:22.04:LTS | golang-1.17 | 1.17.13-3ubuntu1.3 | UBUNTU-CVE-2023-39323 |
| Ubuntu:22.04:LTS | golang-1.18 | 1.18.1-1ubuntu1.2 | USN-7109-1 |
| Ubuntu:22.04:LTS | golang-1.18 | 1.18.1-1ubuntu1.2 | UBUNTU-CVE-2023-39323 |
| Ubuntu:22.04:LTS | golang-1.20 | 1.20.3-1ubuntu0.1~22.04.1 | USN-6574-1 |
| Ubuntu:22.04:LTS | golang-1.20 | 1.20.3-1ubuntu0.1~22.04.1 | UBUNTU-CVE-2023-39323 |
| Ubuntu:22.04:LTS | golang-1.21 | 1.21.1-1~ubuntu22.04.2 | UBUNTU-CVE-2023-39323 |
| Ubuntu:22.04:LTS | golang-1.21 | 1.21.1-1~ubuntu22.04.2 | USN-6574-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go toolchain | cmd/go | 0 – before 1.20.91.21.0-0 – before 1.21.2 |
References
- https://go.dev/issue/63211
- https://go.dev/cl/533215
- https://groups.google.com/g/golang-announce/c/XBa1oHDevAo
- https://pkg.go.dev/vuln/GO-2023-2095
- https://security.netapp.com/advisory/ntap-20231020-0001/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/
- https://security.gentoo.org/glsa/202311-09