Skip to content
CVE PROGRAM SOURCE RECORD6.4 Medium

CVE-2024-24787

Arbitrary code execution during build on Darwin in cmd/go

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go toolchain cmd/go

Default version status: unaffected

  • 0 to < 1.21.10affected
  • 1.22.0-0 to < 1.22.3affected

References