Bug 1224017 (CVE-2024-24787)

Summary:	VUL-0: CVE-2024-24787: go1.21,go1.22: cmd/go: arbitrary code execution during build on darwin
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Jeff Kowalczyk <jkowalczyk>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	gianluca.gabrielli, meissner, rfrohl
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/404708/
Whiteboard:	CVSSv3.1:SUSE:CVE-2024-24787:6.4:(AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Jeff Kowalczyk 2024-05-07 20:18:52 UTC

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

Thanks to Juho Forsén of Mattermost for reporting this issue.

This is CVE-2024-24787 and Go issue https://go.dev/issue/67119.

Comment 1 OBSbugzilla Bot 2024-05-07 21:15:05 UTC

This is an autogenerated message for OBS integration:
This bug (1224017) was mentioned in
https://build.opensuse.org/request/show/1172535 Factory / go1.21
https://build.opensuse.org/request/show/1172536 Factory / go1.22

Comment 3 Maintenance Automation 2024-05-09 12:30:05 UTC

SUSE-SU-2024:1574-1: An update that solves one vulnerability and has one security fix can now be installed.

Category: security (moderate)
Bug References: 1212475, 1224017
CVE References: CVE-2024-24787
Maintenance Incident: [SUSE:Maintenance:33758](https://smelt.suse.de/incident/33758/)
Sources used:
SUSE Linux Enterprise Software Development Kit 12 SP5 (src):
 go1.21-1.21.10-1.33.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 4 Maintenance Automation 2024-05-09 12:30:07 UTC

SUSE-SU-2024:1573-1: An update that solves two vulnerabilities and has one security fix can now be installed.

Category: security (moderate)
Bug References: 1218424, 1224017, 1224018
CVE References: CVE-2024-24787, CVE-2024-24788
Maintenance Incident: [SUSE:Maintenance:33755](https://smelt.suse.de/incident/33755/)
Sources used:
SUSE Linux Enterprise Software Development Kit 12 SP5 (src):
 go1.22-1.22.3-1.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 5 Maintenance Automation 2024-05-10 08:30:21 UTC

SUSE-SU-2024:1588-1: An update that solves one vulnerability and has one security fix can now be installed.

Category: security (moderate)
Bug References: 1212475, 1224017
CVE References: CVE-2024-24787
Maintenance Incident: [SUSE:Maintenance:33756](https://smelt.suse.de/incident/33756/)
Sources used:
openSUSE Leap 15.5 (src):
 go1.21-1.21.10-150000.1.33.1
openSUSE Leap 15.6 (src):
 go1.21-1.21.10-150000.1.33.1
Development Tools Module 15-SP5 (src):
 go1.21-1.21.10-150000.1.33.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src):
 go1.21-1.21.10-150000.1.33.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src):
 go1.21-1.21.10-150000.1.33.1
SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src):
 go1.21-1.21.10-150000.1.33.1
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src):
 go1.21-1.21.10-150000.1.33.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src):
 go1.21-1.21.10-150000.1.33.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 6 Maintenance Automation 2024-05-10 08:30:23 UTC

SUSE-SU-2024:1587-1: An update that solves two vulnerabilities and has one security fix can now be installed.

Category: security (moderate)
Bug References: 1218424, 1224017, 1224018
CVE References: CVE-2024-24787, CVE-2024-24788
Maintenance Incident: [SUSE:Maintenance:33754](https://smelt.suse.de/incident/33754/)
Sources used:
openSUSE Leap 15.5 (src):
 go1.22-1.22.3-150000.1.15.1
openSUSE Leap 15.6 (src):
 go1.22-1.22.3-150000.1.15.1
Development Tools Module 15-SP5 (src):
 go1.22-1.22.3-150000.1.15.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 9 Andrea Mattiazzo 2024-07-19 12:36:18 UTC

All done, closing.