CVE-2023-39323

A flaw was found in the golang cmd/go standard library. A line directive ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to pass during compilation. This can result in the unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.

This attack requires knowledge of the absolute path to the file containing the malicious directive, which significantly limits its feasibility for external attackers unless they already have local access or detailed knowledge of the system's layout. To exploit the vulnerability, an attacker must also convince a developer to download and build a malicious Go module—an action typically constrained by trusted workflows and package verification.

Importantly, this vulnerability does not impact running applications. Instead, it targets the development process, specifically developers or CI/CD pipelines during the build phase, further narrowing its scope.

As a result, this issue has been rated Moderate due to the multiple complex and unlikely prerequisites required for a successful exploit.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.