blob: ffa5dc118610b662bcaabefe43d23cc660c58784 [file] [log] [blame]
id: GO-2022-0201
modules:
- module: cmd
versions:
- fixed: 1.8.7
- introduced: 1.9.0-0
fixed: 1.9.4
vulnerable_at: 1.9.3
packages:
- package: cmd/go
skip_fix: 'TODO: revisit this reason (cant request explicit version of standard library package cmd/go)'
summary: Remote command execution via "go get" command with cgo in cmd/go
description: |-
The "go get" command with cgo is vulnerable to remote command execution by
leveraging the gcc or clang plugin feature.
When cgo is enabled, the build step during "go get" invokes the host C compiler,
gcc or clang, adding compiler flags specified in the Go source files. Both gcc
and clang support a plugin mechanism in which a shared-library plugin is loaded
into the compiler, as directed by compiler flags. This means that a Go package
repository can contain an attack.so file along with a Go source file that says
(for example) "// #cgo CFLAGS: -fplugin=attack.so" causing the attack plugin to
be loaded into the host C compiler during the build. Gcc and clang plugins are
completely unrestricted in their access to the host system.
published: 2022-08-09T18:15:41Z
cves:
- CVE-2018-6574
credits:
- Christopher Brown of Mattermost
references:
- fix: https://go.googlesource.com/go/+/1dcb5836ad2c60776561da2923c70576ba2eefc6
- report: https://go.dev/issue/23672
- web: https://groups.google.com/g/golang-nuts/c/Gbhh1NxAjMU
review_status: REVIEWED