CVE-2023-39323
High
Description
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.
SeverityHigh
CVSS8.1
Exploit probability—
Product
Go
PublishedOct 5, 2023
First seenOct 5, 2023
How to fix
Update
- golang go1.20.9, 1.21.2 or later
- toolchain1.20.9, 1.21.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| golang go | v < 1.20.9, 1.21.0 ≤ v < 1.21.2 | 1.20.9, 1.21.2 |
| fedoraproject fedora | 37, 38, 39 | — |
| toolchainGo | v < 1.20.9, 1.21.0-0 ≤ v < 1.21.2 | 1.20.9, 1.21.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.