CVE-2024-24787 Arbitrary code execution during build on Darwin in cmd/go
Attackers can execute arbitrary code during Go module builds on Darwin by exploiting CGO linker flags, affecting developers using the Go toolchain.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-24787?
CVE-2024-24787 is a medium-severity code injection vulnerability in cmd/go, published on 8 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.
Which versions are affected by CVE-2024-24787?
2 open source packages ship an affected version, including golang and toolchain.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.21.10, 1.22.3 |
toolchain Go | All versions | 1.21.10, 1.22.3 |
Linux distribution packages (9)
go1.21 SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 1.21.10-150000.1.33.1 |
go1.21 SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 1.21.10-150000.1.33.1 |
go1.21 SUSE:Linux Enterprise Module for Development Tools 15 SP5 | All versions | 1.21.10-150000.1.33.1 |
go1.21 SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 1.21.10-150000.1.33.1 |
go1.21 SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 1.21.10-150000.1.33.1 |
go1.21 SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 1.21.10-1.33.1 |
go1.21 openSUSE:Leap 15.5 | All versions | 1.21.10-150000.1.33.1 |
go1.21 openSUSE:Leap 15.6 | All versions | 1.21.10-150000.1.33.1 |
go1.21 openSUSE:Tumbleweed | All versions | 1.21.10-1.1 |
How do I fix CVE-2024-24787?
Upgrade golang to a fixed version for your release line: 1.21.10 or 1.22.3.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-24787 being exploited?
There is no known exploitation of CVE-2024-24787 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as AZL-40428, AZL-79058, AZL-98835, BIT-golang-2024-24787, GHSA-5fq7-4mxc-535h, GO-2024-2825 and 6 more.