CVE-2020-28366: Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo
An input validation vulnerability was found in Go. From a generated go file (from the cgo tool), it is possible to modify symbols within that object file and specify code. This flaw allows an attacker to create a repository that includes malicious pre-built object files that could execute arbitrary code when downloaded and run via go get or go build while building a Go project. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Other sources
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
Golang Go could allow a remote attacker to execute arbitrary code on the system, caused by a code injection flaw in go command when cgo is in use in build time. By using a specially-crafted package, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
The go command may execute arbitrary code at build time when cgo is in use. This may occur when running go get on a malicious package, or any other command that builds untrusted code. This can be caused by malicious unquoted symbol names. This has been fixed by rejecting invalid symbols which may add a //go:cgoldflag directive to the generated file, and by ensuring that the go tool follows existing LDFLAG restrictions.
References: https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM/m/fLguyiM2CAAJ https://github.com/golang/go/issues/42559
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/openshift-serverless-clientsto a version that resolves this vulnerability.Fixed in 0:0.18.4-2.el8 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.14-0:1.14.12-1.el7_9 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.14-golang-0:1.14.12-1.el7_9 - Upgrade
Upgrade
redhat/goto a version that resolves this vulnerability.Fixed in 1.15.5 - Upgrade
Upgrade
redhat/goto a version that resolves this vulnerability.Fixed in 1.14.12 - Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.15.5-r0 - Configuration
Set CGO_ENABLED=0 when using go get or go build if the project and its dependencies do not rely on cgo.
Go cgo CGO_ENABLED = 0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this Go code injection vulnerability?
The vulnerability ID for this Go code injection vulnerability is CVE-2020-28366.
What is the severity of CVE-2020-28366?
The severity of CVE-2020-28366 is high with a CVSS score of 7.5.
Which versions of Go are affected by this vulnerability?
Versions before Go 1.14.12 and Go 1.15.5 are affected by this vulnerability.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by modifying symbols within a generated go file and specifying malicious code.
What is the remedy for this vulnerability?
The remedy for this vulnerability is to update to Go 1.14.12 or Go 1.15.5.