Skip to content
Fencer Vulns
high 7.8

CVE-2023-29403 json

Unsafe behavior in setuid/setgid binaries in runtime

published 2023-06-08 3 y ago modified 2026-09-08 2 mo ago also BIT-golang-2023-29403 , EUVD-2023-32974 , GO-2023-1840

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits
0
none known

Summary

On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.

Patch / fix

  • bitnami golang 1.19.10, 1.20.5
  • go stdlib 1.19.10, 1.20.5
  • Go standard library runtime 1.19.10, 1.20.5
  • golang-1.17 Ubuntu 22.04 LTS 1.17.13-3ubuntu1.2
  • golang-1.18 Ubuntu 20.04 LTS 1.18.1-1ubuntu1~20.04.3
  • golang-1.18 Ubuntu 22.04 LTS 1.18.1-1ubuntu1.2
  • golang-1.18 Ubuntu Pro 16.04 LTS 1.18.1-1ubuntu1~16.04.6+esm1
  • golang-1.18 Ubuntu Pro 18.04 LTS 1.18.1-1ubuntu1~18.04.4+esm1

ubuntu advisories UBUNTU-CVE-2023-29403

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang RHEL 9 1.19.10-1.el9_2
  • go-toolset RHEL 9 1.19.10-1.el9_2
  • golang-bin RHEL 9 1.19.10-1.el9_2
  • golang-src RHEL 9 1.19.10-1.el9_2
  • golang-misc RHEL 9 1.19.10-1.el9_2
  • golang-race RHEL 9 1.19.10-1.el9_2
  • golang-tests RHEL 9 1.19.10-1.el9_2
  • delve RHEL 8 1.9.1-1.module+el8.8.0+16778+5fbb74f5

red hat advisories RHSA-2023:3923RHSA-2023:3922RHSA-2023:3920

  • go1.20 SLE Real Time 15 SP3, SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4 +2 more 1.20.5-150000.1.14.1
  • go1.19 SLE Real Time 15 SP3, SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4 +2 more 1.19.10-150000.1.34.1

suse advisories SUSE-SU-2023:2526-1SUSE-SU-2023:2525-1

  • go1.19 openSUSE Tumbleweed 1.19.10-1.1
  • go1.20 openSUSE Tumbleweed 1.20.5-1.1

opensuse advisories openSUSE-SU-2024:12987-1openSUSE-SU-2024:12988-1

  • delve AlmaLinux 8 1.9.1-1.module_el8.8.0+3471+a62632a0
  • golang AlmaLinux 8 1.19.10-1.module_el8.8.0+3571+89db2ae0
  • go-toolset AlmaLinux 8 1.19.10-1.module_el8.8.0+3571+89db2ae0
  • golang-bin AlmaLinux 8 1.19.10-1.module_el8.8.0+3571+89db2ae0
  • golang-src AlmaLinux 8 1.19.10-1.module_el8.8.0+3571+89db2ae0
  • golang-misc AlmaLinux 8 1.19.10-1.module_el8.8.0+3571+89db2ae0
  • golang-race AlmaLinux 8 1.19.10-1.module_el8.8.0+3571+89db2ae0
  • golang-tests AlmaLinux 8 1.19.10-1.module_el8.8.0+3571+89db2ae0

almalinux advisories ALSA-2023:3922ALSA-2023:3923

  • golang Rocky Linux 9 1.19.10-1.el9_2
  • go-toolset Rocky Linux 9 1.19.10-1.el9_2

rocky linux advisories RLSA-2023:3923

  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 1.20.5-r0

alpine advisories ALPINE-CVE-2023-29403

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang CBL-Mariner 2.0, Azure Linux 3.0 1.20.7-1
  • msft-golang CBL-Mariner 2.0 1.20.7-1
  • golang CBL-Mariner 2.0 1.21.6-1

azure linux advisories AZL-27112AZL-27121AZL-37301AZL-37368AZL-52789

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-29403 updated cvss 7.8

golang: runtime: unexpected behavior of setuid/setgid binaries

  • Red Hat Ceph Storage 3 golang, golang-bin, golang-src Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests, go-toolset-7-golang
    affected: no fix available
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.19 1.19.10-1.el7_9, go-toolset-1.19-build 1.19.10-1.el7_9, go-toolset-1.19-golang 1.19.10-1.el7_9, go-toolset-1.19-runtime 1.19.10-1.el7_9, go-toolset-1.19-scldevel 1.19.10-1.el7_9, go-toolset-1.19-golang-bin 1.19.10-1.el7_9, +4 more Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.19 1.19.10-1.el7_9, go-toolset-1.19-build 1.19.10-1.el7_9, go-toolset-1.19-golang 1.19.10-1.el7_9, go-toolset-1.19-runtime 1.19.10-1.el7_9, go-toolset-1.19-scldevel 1.19.10-1.el7_9, go-toolset-1.19-golang-bin 1.19.10-1.el7_9, +4 more
    fixed: vendor fix RHSA-2023:3920
  • Red Hat Enterprise Linux AppStream (v. 8) delve 1.9.1-1.module+el8.8.0+16778+5fbb74f5, golang 1.19.10-1.module+el8.8.0+19203+782922b7, go-toolset 1.19.10-1.module+el8.8.0+19203+782922b7, golang-bin 1.19.10-1.module+el8.8.0+19203+782922b7, golang-src 1.19.10-1.module+el8.8.0+19203+782922b7, golang-misc 1.19.10-1.module+el8.8.0+19203+782922b7, +2 more
    fixed: vendor fix RHSA-2023:3922
  • Red Hat Enterprise Linux AppStream (v. 9) golang 1.19.10-1.el9_2, go-toolset 1.19.10-1.el9_2, golang-bin 1.19.10-1.el9_2, golang-src 1.19.10-1.el9_2, golang-misc 1.19.10-1.el9_2, golang-race 1.19.10-1.el9_2, +1 more
    fixed: vendor fix RHSA-2023:3923
  • Red Hat OpenShift GitOps openshift-gitops-1/argo-rollouts-rhel8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
22 mo ago

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
OSV 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.19.10
>=1.20.0, <1.20.5
1.19.10
1.20.5
go stdlib
<1.19.10
>=1.20.0-0, <1.20.5
1.19.10
1.20.5

Affected products

  • Go standard library runtime

Classification

Weakness
  • CWE-668 Exposure of Resource to Wrong Sphere

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.