Vulnerability Description
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Golang | Go | < 1.20.9 |
| Fedoraproject | Fedora | 37 |
References
- https://go.dev/cl/533215Patch
- https://go.dev/issue/63211Issue TrackingPatch
- https://groups.google.com/g/golang-announce/c/XBa1oHDevAoMailing ListRelease Notes
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing ListThird Party Advisory
- https://pkg.go.dev/vuln/GO-2023-2095Vendor Advisory
- https://security.gentoo.org/glsa/202311-09Third Party Advisory
- https://security.netapp.com/advisory/ntap-20231020-0001/Third Party Advisory
- https://go.dev/cl/533215Patch
- https://go.dev/issue/63211Issue TrackingPatch
- https://groups.google.com/g/golang-announce/c/XBa1oHDevAoMailing ListRelease Notes
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing ListThird Party Advisory
FAQ
What is CVE-2023-39323?
CVE-2023-39323 is a vulnerability with a CVSS score of 8.1 (HIGH). Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected e...
How severe is CVE-2023-39323?
CVE-2023-39323 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-39323?
Check the references section above for vendor advisories and patch information. Affected products include: Golang Go, Fedoraproject Fedora.