#VU81964 Input validation error in Go programming language
Vulnerability identifier: #VU81964
Vulnerability risk: Medium
CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-20
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Go programming language
Universal components / Libraries /
Scripting languages
Vendor: Google
Description
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input when processing line directives (e.g. "//line") in the code. A remote attacker can bypass restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build".
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Go programming language: 1.21 rc1 - 1.21.1, 1.20 - 1.20.8
External links
http://pkg.go.dev/vuln/GO-2023-2095
http://groups.google.com/g/golang-announce/c/XBa1oHDevAo
http://go.dev/cl/533215
http://go.dev/issue/63211
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
