On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade delveUpgrade golang-miscUpgrade golang-raceUpgrade golang-testsUpgrade go-toolsetUpgrade golang-docsUpgrade golang-binUpgrade golang-srcUpgrade golang | Jun 30, 2023 | Jun 8, 2023 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Jun 8, 2023 |
| Amazon Linux Ami 2 | — | Upgrade golang-raceUpgrade containerd-stressUpgrade golangUpgrade golang-miscUpgrade golang-docsUpgrade golang-binUpgrade golang-testsUpgrade containerd-debuginfoUpgrade containerdUpgrade golang-sharedUpgrade golang-src | Jul 27, 2023 | Jun 8, 2023 |
| Amazon_linux | — | Upgrade golang | Oct 7, 2023 | Jun 8, 2023 |
| Amazon_linux_2023 | — | Upgrade golang-binUpgrade golang-testsUpgrade golang-miscUpgrade golangUpgrade containerd-stressUpgrade golang-docsUpgrade containerd-stress-debuginfoUpgrade containerd-debuginfoUpgrade golang-srcUpgrade containerdUpgrade containerd-debugsourceUpgrade golang-shared | Feb 17, 2025 | Jun 8, 2023 |
| Centos_linux | — | Upgrade golangUpgrade delve-debuginfoUpgrade golang-srcUpgrade go-toolsetUpgrade golang-miscUpgrade golang-raceUpgrade golang-testsUpgrade delve-debugsourceUpgrade golang-docsUpgrade delveUpgrade golang-bin | Jun 30, 2023 | Jun 8, 2023 |
| Debian | — | No solution exists | May 15, 2025 | Jun 8, 2023 |
| Freebsd | — | Upgrade go120Upgrade go119 | Aug 3, 2023 | Aug 2, 2023 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Jun 8, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Jan 10, 2024 | Jun 8, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Jan 10, 2024 | Jun 8, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Mar 18, 2025 | Jun 8, 2023 |
| Oracle_linux | — | Upgrade golang-docsUpgrade golang-raceUpgrade golang-testsUpgrade delveUpgrade golangUpgrade golang-miscUpgrade golang-srcUpgrade golang-binUpgrade go-toolset | Jul 5, 2023 | Jun 8, 2023 |
| Redhat_linux | — | Upgrade go-toolsetUpgrade golang-binUpgrade golang-docsUpgrade delveUpgrade delve-debuginfoUpgrade golang-miscUpgrade golangUpgrade golang-srcUpgrade golang-raceUpgrade delve-debugsourceUpgrade golang-tests | Jun 30, 2023 | Jun 8, 2023 |
| Rocky_linux | — | Upgrade go-toolsetUpgrade golang-binUpgrade golang-raceUpgrade golang | Mar 5, 2024 | Jun 8, 2023 |
| Suse | — | Upgrade go1.20-docUpgrade go1.19Upgrade go1.20Upgrade go1.19-docUpgrade go1.19-raceUpgrade go1.20-race | Jun 19, 2023 | Jun 8, 2023 |
| Ubuntu | — | Upgrade golang-1.18-goUpgrade golang-1.18Upgrade golang-1.17Upgrade golang-1.17-srcUpgrade golang-1.18-srcUpgrade golang-1.18 (Ubuntu Pro)Upgrade golang-1.17-goUpgrade golang-1.18-src (Ubuntu Pro)Upgrade golang-1.18-go (Ubuntu Pro) | Oct 11, 2024 | Jun 8, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 8, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub