CVE-2023-29405

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
Go toolchain	cmd/go	< 1.19.10; >= 1.20.0-0, < 1.20.5
Go toolchain	cmd/cgo	< 1.19.10; >= 1.20.0-0, < 1.20.5

References

https://go.dev/cl/501224Patch
https://go.dev/issue/60306Issue Tracking
https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/Mailing List
https://pkg.go.dev/vuln/GO-2023-1842Vendor Advisory
https://security.gentoo.org/glsa/202311-09
https://go.dev/cl/501224Patch
https://go.dev/issue/60306Issue Tracking
https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/Mailing List
https://pkg.go.dev/vuln/GO-2023-1842Vendor Advisory
https://security.gentoo.org/glsa/202311-09
https://security.netapp.com/advisory/ntap-20241206-0003/

Timeline

Published: Jun 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-294066.5The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers o CVE-2023-294076.5A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cau CVE-2023-294086.5The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small i CVE-2023-294095.3Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the CVE-2023-29414.3Inappropriate implementation in Extensions API in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a CVE-2023-294108.8A CWE-20: Improper Input Validation vulnerability exists that could allow an authenticated attacker to gain the same privilege as the applic CVE-2023-294119.8A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow changes to administrative credentials, leading CVE-2023-294129.8CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause rem CVE-2023-294137.5A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause Denial-of-Service when accessed by an unauthen CVE-2023-294147.8A CWE-120: Buffer Copy without Checking Size of Input (Classic Buffer Overflow) vulnerability exists that could cause user privilege escalat CVE-2023-294156.5An issue was discovered in libbzip3.a in bzip3 before 1.3.0. A denial of service (process hang) can occur with a crafted archive because bzi CVE-2023-294166.5An issue was discovered in libbzip3.a in bzip3 before 1.3.0. A bz3_decode_block out-of-bounds write can occur with a crafted archive because