CVE-2023-29403
High
Description
On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.
SeverityHigh
CVSS7.8
Exploit probability—
Product
Go
PublishedJun 8, 2023
First seenJun 8, 2023
Weakness typeCWE-642CWE-642
How to fix
Update
- golang go1.19.10, 1.20.5 or later
- stdlib1.19.10, 1.20.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| golang go | v < 1.19.10, 1.20.0 ≤ v < 1.20.5 | 1.19.10, 1.20.5 |
| fedoraproject fedora | 38 | — |
| stdlibGo | v < 1.19.10, 1.20.0-0 ≤ v < 1.20.5 | 1.19.10, 1.20.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.