CVE-2024-24787: Arbitrary code execution during build on Darwin in cmd/go

Deferred

AliasesSUSE-SU-2024:1574-1SUSE-SU-2024:1588-1CGA-23g7-prvw-cmcv+766 more

Published 08-05-2024Last modified 13-02-2025

Vulnerability summary

CVE-2024-24787 is a medium (CVSS 6.4) vulnerability in go toolchain cmd/go. EPSS estimates a 0.76% chance of exploitation in the next 30 days, higher than 55.3% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.4, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.4/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.76%

0%100%

Low · -0.01 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 448

OPENSUSE-SU-2024:13936-1 SUSE-SU-2024:1573-1 SUSE-SU-2024:1587-1 SUSE-SU-2024:3089-1 SUSE-SU-2024:3755-1 SUSE-SU-2024:3772-1+94 more

Showing 100 of 448.

Timeline

08-05-2024
PublishedVulnerability first disclosed.
13-02-2025
Last modifiedVulnerability information updated.

Description

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

CVSS metrics

2 scores · 2 sources · 1 version

v3.16.4

EPSS trend

Probability

0.76%

Chance of exploitation in the next 30 days

Percentile

55%

Versus all other CVEs

30-day change

Decrease -0.01 pp

From 0.77% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

aactl< 0.4.12-r12
actions-runner-controller-fips< 0.9.1-r1
actions-runner-controller-fips-compat< 0.9.1-r1
addon-resizer-fips< 1.8.21-r0
addon-resizer-fips-compat< 1.8.21-r0

argo-workflows< 3.6.5-r2
argo-workflows-fips< 3.5.6-r2
atlantis< 0.27.3-r1
atlantis-fips< 0.27.3-r1
aws-ebs-csi-driver< 1.30.0-r1
aws-efs-csi-driver< 2.0.2-r1
aws-efs-csi-driver-fips< 1.7.0-r10
aws-flb-cloudwatch-compat-fips< 1.9.4-r3
aws-flb-cloudwatch-fips< 1.9.4-r3
aws-flb-firehose-compat-fips< 1.7.2-r3
aws-flb-firehose-fips< 1.7.2-r3
aws-flb-kinesis-compat-fips< 1.10.2-r4
aws-flb-kinesis-fips< 1.10.2-r4
aws-load-balancer-controller-fips< 2.7.2-r4
azure-aad-pod-identity-mic< 1.8.17-r9
azure-aad-pod-identity-nmi< 1.8.17-r9
bank-vaults< 1.20.4-r13
bank-vaults-fips< 1.20.4-r10
bank-vaults-template-fips< 1.20.4-r10
bom< 0.6.0-r5
boring-registry< 0.14.0-r1
boring-registry-fips< 0.14.0-r1
buildkitd< 0.13.2-r1
caddy< 2.7.6-r9
caddy-fips< 2.7.6-r6
caddy-man< 2.7.6-r6
cadvisor< 0.49.1-r7
cadvisor-fips< 0.49.1-r6
capslock< 0.2.2-r2
cass-operator-compat-fips< 1.20.0-r1
cass-operator-fips< 1.20.0-r1
cass-operator-fips-no-pvc-delete< 1.20.0-r1
cass-operator-fips-no-pvc-delete-compat< 1.20.0-r1
cert-exporter< 2.12.0-r5
cert-exporter-fips< 2.12.0-r6
cert-manager-webhook-pdns< 2.5.1-r3
cert-manager-webhook-pdns-fips< 2.5.1-r4
certificate-transparency< 1.1.8-r3
certificate-transparency-fips< 1.1.8-r4
certificate-transparency-fips-trillian-ctserver< 1.1.8-r4
cfssl< 1.6.5-r4
chainctl< 0.2.59-r0
chartmuseum< 0.16.1-r10
cilium-cli< 0.16.7-r1
cilium-fips-1.15< 1.15.4-r2
cilium-fips-1.15-clustermesh-apiserver< 1.15.4-r2
cilium-fips-1.15-container-init< 1.15.4-r2
cilium-fips-1.15-container-init-compat< 1.15.4-r2
cilium-fips-1.15-host-utils< 1.15.4-r2
cilium-fips-1.15-hubble-relay< 1.15.4-r2
cilium-fips-1.15-operator-aws< 1.15.4-r2
cilium-fips-1.15-operator-azure< 1.15.4-r2
cilium-fips-1.15-operator-generic< 1.15.4-r2
cloudflared< 2024.1.0-r10
configmap-reload< 0.13.0-r1
configmap-reload-fips< 0.12.0-r7
configmap-reload-fips-0.11< 0.11.1-r8
confluent-common-docker< 7.6.0-r5
conftest< 0.52.0-r1
conftest-fips< 0.52.0-r1
cortex< 1.17.0-r1
cortex-fips< 1.17.0-r1
cosign< 2.2.4-r4
cosign-fips< 2.2.4-r2
crane< 0.19.1-r5
cri-tools< 1.30.0-r2
croc< 9.6.15-r1
crossplane-provider-aws< 1.4.0-r1
crossplane-provider-azure< 1.1.0-r1
crossplane-provider-gcp< 1.1.0-r1
ctop< 0.7.7-r14
cue< 0.8.2-r1
cue-fips< 0.8.2-r1
dask-gateway< 2024.1.0-r4
delve< 1.22.1-r4
dex< 2.39.1-r2
dex-fips< 2.39.1-r1
dex-k8s-authenticator< 1.4.0-r9
dgraph< 23.1.1-r1
direnv< 2.34.0-r3
dive< 0.12.0-r5
docker-compose< 2.27.0-r1
docker-credential-acr-env< 0.7.0-r12
docker-credential-cgr< 0.2.59-r0
docker-credential-ecr-login< 0.7.1-r11
docker-credential-gcr< 2.1.22-r5
dockerize< 0.7.0-r8
dockerize-fips< 0.7.0-r8
dynamic-localpv-provisioner< 4.0.0-r3
dynamic-localpv-provisioner-fips< 4.0.0-r4
eck-operator< 2.16.1-r4
eck-operator-compat< 2.16.1-r4
eksctl< 0.176.0-r1
etcd-3.4< 3.4.32-r1
etcd-3.5< 3.5.13-r3
etcd-fips-3.4< 3.4.32-r1
etcd-fips-3.5< 3.5.13-r4
external-secrets-fips< 0.9.17-r1
extism< 1.4.0-r0
falcoctl< 0.7.3-r9
falcoctl-fips< 0.7.3-r10
falcoctl-fips-0.4< 0.4.0-r9
falcosidekick< 2.28.0-r6
falcosidekick-fips< 2.28.0-r7
ferretdb< 1.21.0-r3
flannel< 0.25.1-r2
flux-image-reflector-controller< 0.32.0-r1
flux-kustomize-controller< 1.3.0-r1
flux-notification-controller< 1.3.0-r1
flux-source-controller< 1.3.0-r1
flyte< 1.12.0-r1
frp< 0.58.0-r1
fulcio< 1.4.5-r2
fulcio-fips< 1.4.5-r3
fuse-overlayfs-snapshotter< 1.0.8-r9
ghaudit< 0.4.0-r3
git-lfs< 3.5.1-r4
gitleaks< 8.18.2-r3
gitness< 3.0.0_beta6-r3
gke-gcloud-auth-plugin< 0.0.2-r10
glab< 1.40.0-r1
go-1.20All versions (No fix recorded)
go-1.21< 1.21.10-r0
go-1.22< 1.22.3-r0
go-bindata< 3.1.3-r19
go-licenses< 1.6.0-r13
go-md2man< 2.0.4-r3
gobump< 0.7.7-r2
golangci-lint< 1.58.1-r0
gomplate< 3.11.7-r5
gops< 0.3.28-r10
gostatsd< 28.3.0-r2
gosu< 1.17-r5
gotenberg< 8.5.0-r1
govulncheck< 1.0.2-r4
grafana-agent-operator< 0.40.4-r2
grafana-operator< 5.9.0-r1
grpcurl< 1.9.1-r3
guac< 0.6.0-r1
harbor-cli< 0.0.1-r2
harbor-registry< 3.0.0_alpha1-r3
harbor-registry-fips< 3.0.0_alpha1-r4
harbor-scanner-trivy< 0.31.1-r1
harbor-scanner-trivy-fips< 0.31.1-r1
hcloud< 1.43.1-r1
hello-world-golang< 1.3-r3
helm< 3.14.4-r3
helm-3< 3.19.2-r1
helm-fips< 3.14.4-r2
helm-fips-3< 3.19.2-r0
helm-fips-4< 4.0.1-r1
helm-operator< 1.34.1-r5
helm-operator-fips< 1.34.1-r5
helm-push< 0.10.4-r10
hey< 0.1.4-r13
http-echo< 1.0.0-r6
hubble-ui< 0.13.0-r9
hubble-ui-backend-fips< 0.13.0-r8
influx< 2.7.5-r1
ip-masq-agent< 2.9.3-r11
jitsucom-bulker< 2.6.0-r1
jsonnet-bundler< 0.5.1-r4
k3d< 5.6.3-r2
k8sgpt< 0.3.30-r1
k9s< 0.32.4-r4
kaf< 0.2.8-r3
kafka_exporter< 1.7.0-r3
karpenter-0.35< 0.35.4-r2
karpenter-fips-0.35< 0.35.4-r2
karpenter-fips-0.36< 0.36.1-r1
katib-earlystopping< 0.19.0-r31
katib-suggestion-goptuna-compat< 0.19.0-r40
katib-suggestion-hyperband< 0.19.0-r31
katib-suggestion-hyperopt< 0.19.0-r31 | < 0.19.0-r40
katib-suggestion-nas-darts< 0.19.0-r31
katib-suggestion-nas-enas< 0.19.0-r31
katib-suggestion-optuna-enas< 0.19.0-r31
katib-suggestion-pbt-enas< 0.19.0-r31
katib-suggestion-skopt-enas< 0.19.0-r31
katib-tfevent-metricscollector< 0.19.0-r31
kind< 0.22.0-r4
ko< 0.15.2-r9
ko-fips< 0.15.2-r6
kpt< 1.0.0_beta49-r6
ksops< 4.3.1-r1
kube-bench< 0.7.3-r2
kube-bench-fips< 0.7.3-r2
kube-oidc-proxy< 1.0.6-r8
kube-state-metrics< 2.12.0-r3
kube-state-metrics-2.6< 2.6.0-r13
kube-state-metrics-fips< 2.12.0-r4
kubebuilder< 3.14.2-r1
kubecolor< 0.3.2-r1
kubernetes-csi-driver-hostpath< 1.13.0-r4
kubernetes-csi-external-provisioner< 4.0.1-r2

Show all 200

1 vendor · 200 products · Showing 200 of 597

References

12 links

Show all 12 references

www.suse.com/support/update/announcement/2024/suse-su-20241588-1/Advisory
nvd.nist.gov/vuln/detail/CVE-2024-24787OvalAdvisory