CVE-2023-39323high

CVE-2023-39323: high-severity vulnerability in Go toolchain cmd/go

Arbitrary code execution during build via line directives in cmd/go

Published · Updated

Follow this CVE+ Monitor cmd/go+ Monitor go

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 1.9%
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Go toolchain · cmd/go
Related CVEs — Go toolchain cmd/go

In the same product, most dangerous first.

CVE-2020-28367—Arbitrary code execution via the go command with cgo in cmd/goEPSS 2.4%CVE-2020-28366—Arbitrary code execution in go command with cgo in cmd/go and cmd/cgoEPSS 2.3%CVE-2023-29404CRITICALImproper handling of non-optional LDFLAGS in go command with cgo in cmd/goEPSS 1.8%CVE-2023-39320—Arbitrary code execution via go.mod toolchain directive in cmd/goEPSS 1.8%CVE-2023-29405CRITICALImproper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/goEPSS 1.7%CVE-2023-29402CRITICALCode injection via go command with cgo in cmd/goEPSS 1.7%