CVE-2023-29403: stdlib - Unexpected Behavior of setuid/setgid Binaries
Summary
CVE-2023-29403: On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. Affects golang-1.15 versions < 7fe60b5df764f5a16a2c40e4412b5ed60f709192. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The stdlib package is a part of the Go programming language and provides a collection of standard libraries for various functionalities. It includes essential packages for file I/O, networking, cryptography, and more. The vulnerability identified as CVE-2023-29403 affects the stdlib package in Go versions 1.18.2 and earlier.
Vulnerability Detail
The vulnerability arises from the unexpected behavior of setuid/setgid binaries in the Go runtime on Unix platforms. When a binary with setuid/setgid bits is executed, the Go runtime does not differentiate its behavior. This can lead to dangerous situations, such as memory state dumping or incorrect assumptions about standard I/O file descriptors. If a setuid/setgid binary is run with closed standard I/O file descriptors, opening files can result in reading or writing unexpected content with elevated privileges. Additionally, if a setuid/setgid program is terminated, it may leak the contents of its registers.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed versions of the Go programming language and the stdlib package.
Conclusion
The vulnerability identified as CVE-2023-29403 in the stdlib package of the Go programming language can lead to unexpected behavior and potential privilege escalation when executing setuid/setgid binaries. It is crucial to update to the fixed versions of the Go programming language and the stdlib package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang-1.15 →
FAQ
The vulnerability can allow malicious actors to read or write unexpected content with elevated privileges when executing setuid/setgid binaries with closed standard I/O file descriptors. It may also lead to the leakage of register contents upon termination of setuid/setgid programs.
The vulnerability affects Go versions 1.18.2 and earlier.
There are no known exploits for this vulnerability at the time of this report.
No, the vulnerability requires a code fix provided in the updated versions of the Go programming language and the stdlib package.
There is no evidence of active exploitation of this vulnerability at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
