9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-29402

CVE-2023-29402: The go command may generate unexpected code at build time when using cgo. This may result in...

The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-29402

CVE-2023-29402:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability occurs because the 'go' command did not properly sanitize directory names containing newline characters when cgo is used. This could lead to parts of the directory path being injected as code during the cgo processing step, specifically when '#line' or '//line' directives are generated.

The patch addresses this in two main places:

In src/cmd/go/internal/load/pkg.go, a check is added to explicitly disallow package directory paths (p.Dir) containing newline characters. The function responsible for loading package details would have been the entry point for the malicious path.
In src/cmd/go/internal/work/exec.go, a check is added to ensure that if a package has an error (p.Error is not nil, which would now be set by the aforementioned check), the build process for that package is halted. This prevents the invocation of cgo with an invalid path.

The vulnerable functions are those that, prior to the patch, would have processed these newline-containing paths and passed them along to the cgo processing stages, or failed to stop the build process when such a path was encountered. The names are inferred based on common Go practices and the context in the diff, as exact function signatures are not always present in diffs alone. The confidence is 'medium' because the exact function names are inferred from the context of the file and typical Go program structure rather than being explicitly stated in the diff for the modified code blocks themselves.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.