Go Command Line Tool Arbitrary Code Execution Vulnerability on Darwin

A vulnerability in the Go command line tool (cmd/go) has been identified, allowing arbitrary code execution during the build process on Darwin systems. This issue arises when a Go module that includes CGO is built using the Apple version of the linker (ld). The vulnerability is triggered by the use of special values such as @executable_path, @loader_path, or @rpath in a '#cgo LDFLAGS' directive. This problem is specific to Go version 1.24 release candidate 2.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution on the user's machine.

Reproduction

To reproduce this vulnerability, create a Go module that includes CGO and use the Apple version of the linker. In the '#cgo LDFLAGS' directive, include the @executable_path, @loader_path, or @rpath special values. Then, build the module using Go 1.24rc2 on a Darwin system. The arbitrary code execution will occur during the build process.

Remediation

Users can upgrade to Go 1.24 release candidate 3 or later, where this vulnerability has been fixed.