7.8Hoch

CVE-2025-61731Arbitrary file write using cgo pkg-config directive in cmd/go

Go toolchain cmd/go; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 8 Veröffentlicht: 2026-01-28 22:30 (vor 9 Monaten)

Beschreibung

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.

Schwachstellentyp (CWE): CWE-78 CWE-88

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
Go toolchain	cmd/go	< 1.24.12, 1.25.0 – < 1.25.6
golang	go	< 1.24.12
openshift	4.12	—
openshift	4.13	—
Red Hat	Red Hat Enterprise Linux 10	all versions
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8	all versions
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	all versions
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	all versions
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	all versions
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9	all versions
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	all versions
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	all versions
Red Hat	Red Hat Hardened Images	all versions
Red Hat	Red Hat OpenShift Container Platform 4.12	all versions

Referenzen und Patches

CPE-Treffer (NVD) (2)

cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* < 1.24.12
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* ≥ 1.25.0 < 1.25.6

CVSS-Score

7.8Hoch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Lokal
Komplexität: Niedrig
Rechte erforderlich: Niedrig
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Alle Scores (4)

CISA-ADP	CVSS 3.1	7.8Hoch
redhat-SADP	CVSS 3.1	8.6Hoch
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	7.8Hoch
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	CVSS 3.1	8.6Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.61%

höher als 50 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: no
Technische Auswirkung: total

Zeitverlauf

ID reserviert2025-09-30
Veröffentlicht2026-01-28 22:30
Bei IP-DB eingegangen2026-10-25 00:01
Zuletzt aktualisiert2026-09-10 16:17

Vergeben von (CNA): Go
NVD-Status: Modified

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Go

Ohne Score

CVE-2026-97033 vor 12 Stunden

Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/go

Go toolchain cmd/go

Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives. Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and …

Ohne Score

CVE-2026-97034 vor 12 Stunden

Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go

Go toolchain cmd/go

When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in l…

Ohne Score

CVE-2026-97054 vor 12 Stunden

HTTP/1 server crash due to MaxBytesReader header race in net/http

Go standard library net/http

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes …

Ohne Score

CVE-2026-97036 vor 12 Stunden

Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go

Go toolchain cmd/go

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_librar…

Ohne Score

CVE-2026-97035 vor 12 Stunden

Unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/go

Go toolchain cmd/go

When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via "-gen-*" or "-gnat*" flags in "#cgo" directives. The "-g*" wildcard in the compiler and linker …

Ohne Score

CVE-2026-97037 vor 12 Stunden

Linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/go

Go toolchain cmd/go

Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS". Split "-Wl," flags that consume a following argument (such as "-Wl,-rpath", "-Wl,--just-symbols"…