Vulnerability Report: GO-2022-0201
- CVE-2018-6574
- Affects: cmd/go
- Published: Aug 09, 2022
- Modified: Jun 12, 2023
The "go get" command with cgo is vulnerable to remote command execution by leveraging the gcc or clang plugin feature. When cgo is enabled, the build step during "go get" invokes the host C compiler, gcc or clang, adding compiler flags specified in the Go source files. Both gcc and clang support a plugin mechanism in which a shared-library plugin is loaded into the compiler, as directed by compiler flags. This means that a Go package repository can contain an attack.so file along with a Go source file that says (for example) "// #cgo CFLAGS: -fplugin=attack.so" causing the attack plugin to be loaded into the host C compiler during the build. Gcc and clang plugins are completely unrestricted in their access to the host system.
Affected Packages
-
PathVersionsSymbols
-
before go1.8.7, from go1.9.0-0 before go1.9.4all symbols
Aliases
References
- https://go.googlesource.com/go/+/1dcb5836ad2c60776561da2923c70576ba2eefc6
- https://go.dev/issue/23672
- https://groups.google.com/g/golang-nuts/c/Gbhh1NxAjMU
- https://vuln.go.dev/ID/GO-2022-0201.json
Credits
- Christopher Brown of Mattermost
Feedback
See anything missing or incorrect?
Suggest an edit to this report.