| id: GO-2022-0475 |
| modules: |
| - module: cmd |
| versions: |
| - fixed: 1.14.12 |
| - introduced: 1.15.0-0 |
| - fixed: 1.15.5 |
| vulnerable_at: 1.15.4 |
| packages: |
| - package: cmd/go |
| symbols: |
| - Builder.cgo |
| skip_fix: 'TODO: revisit this reason (cant request explicit version v1.15.4 of standard library package cmd/go)' |
| - package: cmd/cgo |
| symbols: |
| - dynimport |
| skip_fix: 'TODO: revisit this reason (cant request explicit version v1.15.4 of standard library package cmd/go)' |
| summary: Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo |
| description: |- |
| The go command may execute arbitrary code at build time when cgo is in use. This |
| may occur when running go get on a malicious package, or any other command that |
| builds untrusted code. |
| |
| This can be caused by malicious unquoted symbol name in a linked object file. |
| published: 2022-07-28T17:24:30Z |
| credits: |
| - Chris Brown (Tempus Ex) |
| references: |
| - fix: https://go.dev/cl/269658 |
| - fix: https://go.googlesource.com/go/+/062e0e5ce6df339dc26732438ad771f73dbf2292 |
| - report: https://go.dev/issue/42559 |
| - web: https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM |
| cve_metadata: |
| id: CVE-2020-28366 |
| cwe: 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' |
| description: |- |
| Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows |
| arbitrary code execution at build time via a malicious unquoted symbol name in a |
| linked object file. |
| review_status: REVIEWED |
