PT-2025-5843 · Go+1 · Go+1
Juho Forsén
·
Published
2025-02-06
·
Updated
2025-03-07
·
CVE-2025-22867
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions:
go versions 1.24rc2
Description:
The issue is related to building a Go module that contains CGO on Darwin. It can trigger arbitrary code execution when using the Apple version of ld. This is due to the usage of special values
@executable path, @loader path, or @rpath in a "#cgo LDFLAGS" directive.Recommendations:
For go version 1.24rc2, consider avoiding the use of the Apple version of ld or refrain from using the special values
@executable path, @loader path, or @rpath in the "#cgo LDFLAGS" directive until a patch is available. As a temporary workaround, consider disabling the CGO functionality in the Go module to prevent potential arbitrary code execution.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Suse
Go