CVE-2023-39323: Arbitrary code execution during build via line directives in cmd/go
Arbitrary code execution during build via line directives in cmd/go
Other sources
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.
— Launchpad
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-39323.
What is the severity level of CVE-2023-39323?
CVE-2023-39323 has a severity level of critical.
How can line directives be used to bypass restrictions on go:cgo_ directives?
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives by allowing blocked linker and compiler flags to be passed during compilation.
What software is affected by CVE-2023-39323?
Golang Go versions up to and including 1.20.9, as well as version 1.21.0 up to but excluding 1.21.2, are affected by CVE-2023-39323.
How can I fix CVE-2023-39323?
To fix CVE-2023-39323, it is recommended to update Golang Go to a version that is not affected by the vulnerability.