CVE-2024-24787

Published: 8 May 2024

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

Notes

Packages built using golang need to be rebuilt once the
vulnerability has been fixed. This CVE entry does not
list packages that need rebuilding outside of the main
repository or the Ubuntu variants with PPA overlays.

Warning: do not include nullboot in the list of no-change
rebuilds after fixing an issue in golang.

issue affecting macOS only.

Status

References

• https://www.cve.org/CVERecord?id=CVE-2024-24787
• https://groups.google.com/g/golang-announce/c/wkkO4P9stm0
• https://github.com/golang/go/issues/67119
• NVD
• Launchpad
• Debian