CVE-2021-3115: Arbitrary code injection via the go command with cgo on Windows in cmd/go
Summary
CVE-2021-3115: Arbitrary code injection via the go command with cgo on Windows in cmd/go. Affects toolchain across 2 version ranges.
< 1.14.14
>= 1.15.0-0, < 1.15.7
Fixed in 1.14.14 or 1.15.7, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2021-3115 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'cmd/go' package is a part of the Go toolchain ecosystem. It provides the 'go' command, which is used for various build and package management tasks in Go projects. The vulnerability affects the Windows operating system when using cgo with the 'go' command. This vulnerability allows an attacker to execute arbitrary code during the build process by exploiting the way cgo is handled on Windows.
Vulnerability Detail
The vulnerability (CVE-2021-3115) arises due to a flaw in the go command's handling of cgo on Windows. An attacker can trigger the vulnerability by running 'go get' on a malicious module or whenever the code is built. This can lead to arbitrary code execution at build time, potentially compromising the integrity and security of the system. The vulnerability impacts versions 0.x, 1.14.14, 1.15.0-0, and 1.15.7 of the 'toolchain' package in the Go ecosystem when used on Windows.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.14.141.14.14go get toolchain@v1.14.14 -
>= 1.15.0-0, < 1.15.71.15.7go get toolchain@v1.15.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can avoid using cgo on Windows until the package is updated. This can be achieved by modifying the build configuration to exclude cgo. However, this may not be feasible for all projects and should be considered a temporary solution until the package is patched.
Conclusion
The vulnerability (CVE-2021-3115) in the 'cmd/go' package allows for arbitrary code injection during the build process when using cgo on Windows. It is crucial to update the 'toolchain' package to version 1.15.7 or later to mitigate the vulnerability. As a temporary workaround, users can avoid using cgo on Windows until the package is updated. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for toolchain →
FAQ
The vulnerability allows an attacker to execute arbitrary code during the build process, potentially leading to system compromise and unauthorized access.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file to the playground, and it will alert you if the vulnerability is present.
While there is no known public exploit at the moment, it is crucial to update the package to the fixed version to mitigate any potential risks.
As a temporary workaround, you can avoid using cgo on Windows until the package is updated. However, updating to the fixed version is the recommended approach.
You can find more information about this vulnerability in the Go vulnerability database at https://pkg.go.dev/vuln/GO-2021-0068.
References
Related vulnerabilities
Recent vulnerabilities recorded for toolchain.
