CVE-2025-22867 - Vulnerability Details - OpenCVE

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_path, @loader_path, or @rpath special values in a "#cgo LDFLAGS" directive. This issue only affected go1.24rc2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://go.dev/cl/646996
https://go.dev/issue/71476
https://groups.google.com/g/golang-dev/c/TYzikTgHK6Y
https://nvd.nist.gov/vuln/detail/CVE-2025-22867
https://pkg.go.dev/vuln/GO-2025-3428
https://www.cve.org/CVERecord?id=CVE-2025-22867

History

Fri, 07 Feb 2025 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-94
References		https://nvd.nist.gov/vuln/detail/CVE-2025-22867 https://www.cve.org/CVERecord?id=CVE-2025-22867
Metrics	threat_severity `None`	threat_severity `Important`

Thu, 06 Feb 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 06 Feb 2025 17:30:00 +0000

Type	Values Removed	Values Added
Description		On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_path, @loader_path, or @rpath special values in a "#cgo LDFLAGS" directive. This issue only affected go1.24rc2.
Title		Arbitrary code execution during build on darwin in cmd/go
References		https://go.dev/cl/646996 https://go.dev/issue/71476 https://groups.google.com/g/golang-dev/c/TYzikTgHK6Y https://pkg.go.dev/vuln/GO-2025-3428

MITRE

Status: PUBLISHED

Assigner: Go

Published: 2025-02-06T17:09:56.893Z

Updated: 2025-02-06T21:23:25.105Z

Reserved: 2025-01-08T19:11:42.834Z

Link: CVE-2025-22867

Vulnrichment

Updated: 2025-02-06T20:06:42.113Z

NVD

Status : Received

Published: 2025-02-06T18:15:32.543

Modified: 2025-02-06T22:15:40.393

Link: CVE-2025-22867

Redhat

Severity : Important

Publid Date: 2025-02-06T17:09:56Z

Links: CVE-2025-22867 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-22867", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2025-01-08T19:11:42.834Z", "datePublished": "2025-02-06T17:09:56.893Z", "dateUpdated": "2025-02-06T21:23:25.105Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2025-02-06T17:09:56.893Z"}, "title": "Arbitrary code execution during build on darwin in cmd/go", "descriptions": [{"lang": "en", "value": "On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_path, @loader_path, or @rpath special values in a \"#cgo LDFLAGS\" directive. This issue only affected go1.24rc2."}], "affected": [{"vendor": "Go toolchain", "product": "cmd/go", "collectionURL": "https://pkg.go.dev", "packageName": "cmd/go", "versions": [{"version": "1.24.0-rc.2", "lessThan": "1.24.0-rc.3", "status": "affected", "versionType": "semver"}], "platforms": ["darwin"], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "references": [{"url": "https://go.dev/cl/646996"}, {"url": "https://go.dev/issue/71476"}, {"url": "https://groups.google.com/g/golang-dev/c/TYzikTgHK6Y"}, {"url": "https://pkg.go.dev/vuln/GO-2025-3428"}], "credits": [{"lang": "en", "value": "Juho Fors\u00e9n of Mattermost"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-02-06T20:06:49.179700Z", "id": "CVE-2025-22867", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-06T21:23:25.105Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-22867", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2025-01-08T19:11:42.834Z", "datePublished": "2025-02-06T17:09:56.893Z", "dateUpdated": "2025-02-06T21:23:25.105Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2025-02-06T17:09:56.893Z"}, "title": "Arbitrary code execution during build on darwin in cmd/go", "descriptions": [{"lang": "en", "value": "On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_path, @loader_path, or @rpath special values in a \"#cgo LDFLAGS\" directive. This issue only affected go1.24rc2."}], "affected": [{"vendor": "Go toolchain", "product": "cmd/go", "collectionURL": "https://pkg.go.dev", "packageName": "cmd/go", "versions": [{"version": "1.24.0-rc.2", "lessThan": "1.24.0-rc.3", "status": "affected", "versionType": "semver"}], "platforms": ["darwin"], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "references": [{"url": "https://go.dev/cl/646996"}, {"url": "https://go.dev/issue/71476"}, {"url": "https://groups.google.com/g/golang-dev/c/TYzikTgHK6Y"}, {"url": "https://pkg.go.dev/vuln/GO-2025-3428"}], "credits": [{"lang": "en", "value": "Juho Fors\u00e9n of Mattermost"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-22867", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-06T20:06:49.179700Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-06T20:06:42.113Z"}}]}}

{"bugzilla": {"description": "cmd/go: Arbitrary code execution during build on darwin in cmd/go", "id": "2344234", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344234"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-94", "details": ["On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_path, @loader_path, or @rpath special values in a \"#cgo LDFLAGS\" directive. This issue only affected go1.24rc2.", "A vulnerability was found in the cmd/go golang package. On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld due to usage of the @executable_path, @loader_path, or @rpath special values in a \"#cgo LDFLAGS\" directive."], "mitigation": {"lang": "en:us", "value": "No mitigation is available for this issue other than updating the affected package to the version containing the fix."}, "name": "CVE-2025-22867", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "golang", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "go-toolset:rhel8/golang", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "golang", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "rhel9/go-toolset", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "ubi9/go-toolset", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:storage:3", "fix_state": "Not affected", "package_name": "golang", "product_name": "Red Hat Storage 3"}, {"cpe": "cpe:/a:redhat:trusted_artifact_signer:1", "fix_state": "Not affected", "package_name": "rhtas/fulcio-rhel9", "product_name": "Red Hat Trusted Artifact Signer"}], "public_date": "2025-02-06T17:09:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-22867\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-22867\nhttps://go.dev/cl/646996\nhttps://go.dev/issue/71476\nhttps://groups.google.com/g/golang-dev/c/TYzikTgHK6Y\nhttps://pkg.go.dev/vuln/GO-2025-3428"], "statement": "This issue only affects go1.24rc2. The go1.24rc2 version is not used in any of the Red Hat products, therefore, Red Hat is not affected by this vulnerability.", "threat_severity": "Important"}