Описание
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
A flaw was found in Go's 'cgo tool'. This vulnerability arises from a discrepancy in how Go and C/C++ comments are parsed, which allows for malicious code to be hidden within comments and then "smuggled" into the compiled cgo binary. An attacker could exploit this to embed and execute arbitrary code, potentially leading to significant system compromise.
Отчет
This is an Important vulnerability in the cmd/cgo component of the Go toolchain. A parsing discrepancy between Go and C/C++ comments could allow for code smuggling into the resulting cgo binary. This primarily affects systems where untrusted Go modules utilizing cgo are built, impacting Red Hat Enterprise Linux and OpenShift Container Platform.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 9 | go-toolset | Affected | ||
| Red Hat OpenShift Virtualization 4 | openshift-golang-builder-container | Affected | ||
| Red Hat Enterprise Linux 10 | golang | Fixed | RHSA-2026:2706 | 16.02.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | golang | Fixed | RHSA-2026:3192 | 24.02.2026 |
| Red Hat Enterprise Linux 8 | go-toolset | Fixed | RHSA-2026:2708 | 16.02.2026 |
| Red Hat Enterprise Linux 8.2 Advanced Update Support | go-toolset | Fixed | RHSA-2026:3468 | 02.03.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | go-toolset | Fixed | RHSA-2026:3470 | 02.03.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | go-toolset | Fixed | RHSA-2026:3470 | 02.03.2026 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | go-toolset | Fixed | RHSA-2026:3489 | 02.03.2026 |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | go-toolset | Fixed | RHSA-2026:3489 | 02.03.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.4 High
CVSS3
Связанные уязвимости
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
A discrepancy between how Go and C/C++ comments were parsed allowed fo ...
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
Уязвимость компонента cmd/cgo языка программирования Go, позволяющая нарушителю выполнить произвольный код
EPSS
7.4 High
CVSS3