Skip to content
Fencer Vulns
critical 9.8

CVE-2023-29404 json

Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go

published 2023-06-08 3 y ago modified 2026-09-08 2 mo ago also BIT-golang-2023-29404 , EUVD-2023-32975 , GO-2023-1841

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits
0
none known

Summary

The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers.

Patch / fix

  • bitnami golang 1.19.10, 1.20.5
  • go toolchain 1.19.10, 1.20.5
  • Go toolchain cmd/go 1.19.10, 1.20.5
  • golang-1.17 Ubuntu 22.04 LTS 1.17.13-3ubuntu1.2
  • golang-1.18 Ubuntu 20.04 LTS 1.18.1-1ubuntu1~20.04.3
  • golang-1.18 Ubuntu 22.04 LTS 1.18.1-1ubuntu1.2
  • golang-1.18 Ubuntu Pro 16.04 LTS 1.18.1-1ubuntu1~16.04.6+esm1
  • golang-1.18 Ubuntu Pro 18.04 LTS 1.18.1-1ubuntu1~18.04.4+esm1

ubuntu advisories UBUNTU-CVE-2023-29404

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang RHEL 9 1.19.10-1.el9_2
  • go-toolset RHEL 9 1.19.10-1.el9_2
  • golang-bin RHEL 9 1.19.10-1.el9_2
  • golang-src RHEL 9 1.19.10-1.el9_2
  • golang-misc RHEL 9 1.19.10-1.el9_2
  • golang-race RHEL 9 1.19.10-1.el9_2
  • golang-tests RHEL 9 1.19.10-1.el9_2
  • delve RHEL 8 1.9.1-1.module+el8.8.0+16778+5fbb74f5

red hat advisories RHSA-2023:3923RHSA-2023:3922RHSA-2023:3920

  • go1.20 SLE Real Time 15 SP3, SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4 +2 more 1.20.5-150000.1.14.1
  • go1.19 SLE Real Time 15 SP3, SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4 +2 more 1.19.10-150000.1.34.1

suse advisories SUSE-SU-2023:2526-1SUSE-SU-2023:2525-1

  • go1.19 openSUSE Tumbleweed 1.19.10-1.1
  • go1.20 openSUSE Tumbleweed 1.20.5-1.1

opensuse advisories openSUSE-SU-2024:12987-1openSUSE-SU-2024:12988-1

  • delve AlmaLinux 8 1.9.1-1.module_el8.8.0+3471+a62632a0
  • golang AlmaLinux 8 1.19.10-1.module_el8.8.0+3571+89db2ae0
  • go-toolset AlmaLinux 8 1.19.10-1.module_el8.8.0+3571+89db2ae0
  • golang-bin AlmaLinux 8 1.19.10-1.module_el8.8.0+3571+89db2ae0
  • golang-src AlmaLinux 8 1.19.10-1.module_el8.8.0+3571+89db2ae0
  • golang-misc AlmaLinux 8 1.19.10-1.module_el8.8.0+3571+89db2ae0
  • golang-race AlmaLinux 8 1.19.10-1.module_el8.8.0+3571+89db2ae0
  • golang-tests AlmaLinux 8 1.19.10-1.module_el8.8.0+3571+89db2ae0

almalinux advisories ALSA-2023:3922ALSA-2023:3923

  • golang Rocky Linux 9 1.19.10-1.el9_2
  • go-toolset Rocky Linux 9 1.19.10-1.el9_2

rocky linux advisories RLSA-2023:3923

  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 1.20.5-r0

alpine advisories ALPINE-CVE-2023-29404

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang CBL-Mariner 2.0 1.20.7-1
  • msft-golang CBL-Mariner 2.0 1.19.10-1
  • golang CBL-Mariner 2.0 1.21.6-1
  • golang Azure Linux 3.0 1.22.7-2

azure linux advisories AZL-27140AZL-27150AZL-37337AZL-37510AZL-47146

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-29404 updated cvss 7.5

golang: cmd/go: go command may execute arbitrary code at build time when using cgo

  • Red Hat Ceph Storage 3 golang, golang-bin, golang-src Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests, go-toolset-7-golang
    affected: no fix planned “Will not fix”
  • Red Hat Ceph Storage 5.3 Tools rhceph/rhceph-5-rhel8 5-519, rhceph/keepalived-rhel8 2.1.5-42, rhceph/snmp-notifier-rhel8 1.2.1-69, rhceph/rhceph-5-dashboard-rhel8 5-87, rhceph/rhceph-haproxy-rhel8 2.2.19-35
    fixed: vendor fix RHSA-2024:4119
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.19 1.19.10-1.el7_9, go-toolset-1.19-build 1.19.10-1.el7_9, go-toolset-1.19-golang 1.19.10-1.el7_9, go-toolset-1.19-runtime 1.19.10-1.el7_9, go-toolset-1.19-scldevel 1.19.10-1.el7_9, go-toolset-1.19-golang-bin 1.19.10-1.el7_9, +4 more Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.19 1.19.10-1.el7_9, go-toolset-1.19-build 1.19.10-1.el7_9, go-toolset-1.19-golang 1.19.10-1.el7_9, go-toolset-1.19-runtime 1.19.10-1.el7_9, go-toolset-1.19-scldevel 1.19.10-1.el7_9, go-toolset-1.19-golang-bin 1.19.10-1.el7_9, +4 more
    fixed: vendor fix RHSA-2023:3920
  • Red Hat Enterprise Linux AppStream (v. 8) delve 1.9.1-1.module+el8.8.0+16778+5fbb74f5, golang 1.19.10-1.module+el8.8.0+19203+782922b7, go-toolset 1.19.10-1.module+el8.8.0+19203+782922b7, golang-bin 1.19.10-1.module+el8.8.0+19203+782922b7, golang-src 1.19.10-1.module+el8.8.0+19203+782922b7, golang-misc 1.19.10-1.module+el8.8.0+19203+782922b7, +2 more
    fixed: vendor fix RHSA-2023:3922
  • Red Hat Enterprise Linux AppStream (v. 9) golang 1.19.10-1.el9_2, go-toolset 1.19.10-1.el9_2, golang-bin 1.19.10-1.el9_2, golang-src 1.19.10-1.el9_2, golang-misc 1.19.10-1.el9_2, golang-race 1.19.10-1.el9_2, +1 more
    fixed: vendor fix RHSA-2023:3923

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-046-11 updated cvss 9.8

Siemens SCALANCE XCM-/XRM-300

  • Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2) <V2.4 Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2) <V2.4 Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2) <V2.4 Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) <V2.4 Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) <V2.4 Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) <V2.4
    +5 more products
    Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) <V2.4
    affected: fixed in V2.4 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
22 mo ago

Exploit prediction

1.82% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.19.10
>=1.20.0, <1.20.5
1.19.10
1.20.5
go toolchain
<1.19.10
>=1.20.0-0, <1.20.5
1.19.10
1.20.5

Affected products

  • Go toolchain cmd/go

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.