Описание
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
A flaw was found in Go's 'cgo tool'. This vulnerability arises from a discrepancy in how Go and C/C++ comments are parsed, which allows for malicious code to be hidden within comments and then "smuggled" into the compiled cgo binary. An attacker could exploit this to embed and execute arbitrary code, potentially leading to significant system compromise.
Отчет
This is an Important vulnerability in the cmd/cgo component of the Go toolchain. A parsing discrepancy between Go and C/C++ comments could allow for code smuggling into the resulting cgo binary. This primarily affects systems where untrusted Go modules utilizing cgo are built, impacting Red Hat Enterprise Linux and OpenShift Container Platform.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Exploit Intelligence | exploit-intelligence/vulnerability-analysis-rhel9 | Affected | ||
| Migration Toolkit for Applications 8 | mta/mta-go-external-provider-rhel9 | Affected | ||
| OpenShift Service Mesh 2 | openshift-golang-builder-container | Affected | ||
| OpenShift Service Mesh 3 | openshift-golang-builder-container | Affected | ||
| Red Hat Enterprise Linux 10 | rhel10/go-toolset | Affected | ||
| Red Hat Enterprise Linux 8 | rhel8/go-toolset | Affected | ||
| Red Hat Enterprise Linux 9 | go-toolset | Affected | ||
| Red Hat Enterprise Linux 9 | rhel9/go-toolset | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-operator-sdk-rhel9 | Affected | ||
| Red Hat OpenShift Virtualization 4 | openshift-golang-builder-container | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.4 High
CVSS3
Связанные уязвимости
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
A discrepancy between how Go and C/C++ comments were parsed allowed fo ...
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
EPSS
7.4 High
CVSS3