SB20250212100 - Multiple vulnerabilities in Go programming language

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Code Injection (CVE-ID: CVE-2025-22867)

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to usage of the @executable_path, @loader_path, or @rpath special values in a "#cgo LDFLAGS" directive. A local user can trigger code execution while building a Go module which contains CGO when using the Apple version of ld.

2) Memory leak (CVE-ID: CVE-2025-22866)

The vulnerability exists due to a small number of bits of secret scalars are leaked on the ppc64le architecture in crypto/internal/nistec. A local user can gain access to potentially sensitive information.

Remediation

Install update from vendor's website.

References

• https://go.dev/cl/646996
• https://go.dev/issue/71476
• https://groups.google.com/g/golang-dev/c/TYzikTgHK6Y
• https://pkg.go.dev/vuln/GO-2025-3428
• https://go.dev/cl/643735
• https://go.dev/issue/71383
• https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k
• https://pkg.go.dev/vuln/GO-2025-3447