CVE-2023-29403: Unsafe behavior in setuid/setgid binaries in Go runtime
Summary
CVE-2023-29403: Unsafe behavior in setuid/setgid binaries in runtime. Affects stdlib across 2 version ranges.
< 1.19.10
>= 1.20.0-0, < 1.20.5
Fixed in 1.19.10 or 1.20.5, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2023-29403 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go standard library (stdlib) is a collection of packages that provide essential functionality for Go programs. It includes various modules for tasks such as file I/O, networking, and concurrency. The Go runtime is responsible for managing the execution of Go programs, including memory management and scheduling.
In Unix platforms, setuid/setgid binaries are programs that run with the privileges of the user or group that owns them, rather than the privileges of the user executing them. This allows certain operations to be performed with elevated privileges.
However, the Go runtime does not differentiate the behavior of binaries when run with setuid/setgid bits. This can lead to unsafe behavior in certain scenarios, such as when accessing memory or assuming the status of standard I/O file descriptors.
Vulnerability Detail
The vulnerability in the Go runtime affects setuid/setgid binaries. When such a binary is executed with closed standard I/O file descriptors, opening any files can result in unexpected content being read or written with elevated privileges. Additionally, if a setuid/setgid program is terminated, either due to a panic or a signal, it may leak the contents of its registers. These issues can potentially lead to unauthorized access, data leakage, or privilege escalation.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.19.101.19.10go get stdlib@v1.19.10 -
>= 1.20.0-0, < 1.20.51.20.5go get stdlib@v1.20.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, it is advised to avoid running setuid/setgid binaries with closed standard I/O file descriptors. Keeping the standard I/O file descriptors open can help mitigate the risk of unexpected content being read or written with elevated privileges. Additionally, it is recommended to handle panics and signals properly in setuid/setgid programs to prevent the leakage of register contents.
Conclusion
The vulnerability in the Go runtime's handling of setuid/setgid binaries can lead to unsafe behavior and potential security risks. It is crucial to update the Go runtime to the recommended versions to mitigate these issues. Additionally, following the provided workarounds can help reduce the risk of exploitation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
A setuid/setgid binary is a program that runs with the privileges of the user or group that owns it, rather than the privileges of the user executing it. This allows certain operations to be performed with elevated privileges.
The risks of this vulnerability include unauthorized access, data leakage, and privilege escalation. If a setuid/setgid binary is executed with closed standard I/O file descriptors, it can read or write unexpected content with elevated privileges. Additionally, terminating a setuid/setgid program may leak the contents of its registers.
To fix this vulnerability, update the Go runtime to version 1.19.10 or later, or version 1.20.5 or later. These versions include the necessary changes to address the unsafe behavior in setuid/setgid binaries.
As a workaround, avoid running setuid/setgid binaries with closed standard I/O file descriptors. Keeping the standard I/O file descriptors open can help mitigate the risk of unexpected content being read or written with elevated privileges. Additionally, handle panics and signals properly in setuid/setgid programs to prevent the leakage of register contents.
For more information about this vulnerability, refer to the Go vulnerability database at https://pkg.go.dev/vuln/GO-2023-1840.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
