On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golangUpgrade golang-docsUpgrade golang-testsUpgrade golang-binUpgrade golang-srcUpgrade go-toolsetUpgrade golang-miscUpgrade delveUpgrade golang-race | Jun 30, 2023 | Jun 8, 2023 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Jun 8, 2023 |
| Amazon Linux Ami 2 | — | Upgrade golang-sharedUpgrade containerdUpgrade golang-miscUpgrade golang-srcUpgrade containerd-debuginfoUpgrade golang-docsUpgrade golang-binUpgrade golang-testsUpgrade golangUpgrade containerd-stressUpgrade golang-race | Jul 27, 2023 | Jun 8, 2023 |
| Amazon_linux | — | Upgrade golang | Oct 7, 2023 | Jun 8, 2023 |
| Amazon_linux_2023 | — | Upgrade containerdUpgrade containerd-debuginfoUpgrade golang-sharedUpgrade golang-srcUpgrade containerd-stress-debuginfoUpgrade containerd-debugsourceUpgrade golang-binUpgrade golang-testsUpgrade containerd-stressUpgrade golangUpgrade golang-miscUpgrade golang-docs | Feb 17, 2025 | Jun 8, 2023 |
| Centos_linux | — | Upgrade delve-debuginfoUpgrade golang-srcUpgrade golang-raceUpgrade golang-miscUpgrade golangUpgrade go-toolsetUpgrade golang-docsUpgrade delveUpgrade golang-binUpgrade delve-debugsourceUpgrade golang-tests | Jun 30, 2023 | Jun 8, 2023 |
| Debian | — | No solution exists | May 15, 2025 | Jun 8, 2023 |
| Freebsd | — | Upgrade go119Upgrade go120 | Aug 3, 2023 | Aug 2, 2023 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Jun 8, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Jan 10, 2024 | Jun 8, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Jan 10, 2024 | Jun 8, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Mar 18, 2025 | Jun 8, 2023 |
| Oracle_linux | — | Upgrade golang-srcUpgrade golang-binUpgrade golangUpgrade go-toolsetUpgrade golang-miscUpgrade golang-docsUpgrade delveUpgrade golang-testsUpgrade golang-race | Jul 5, 2023 | Jun 8, 2023 |
| Redhat_linux | — | Upgrade golang-raceUpgrade golang-miscUpgrade golangUpgrade delve-debugsourceUpgrade golang-srcUpgrade golang-testsUpgrade go-toolsetUpgrade delveUpgrade golang-binUpgrade delve-debuginfoUpgrade golang-docs | Jun 30, 2023 | Jun 8, 2023 |
| Rocky_linux | — | Upgrade golangUpgrade golang-raceUpgrade golang-binUpgrade go-toolset | Mar 5, 2024 | Jun 8, 2023 |
| Suse | — | Upgrade go1.20-docUpgrade go1.19Upgrade go1.20Upgrade go1.20-raceUpgrade go1.19-docUpgrade go1.19-race | Jun 19, 2023 | Jun 8, 2023 |
| Ubuntu | — | Upgrade golang-1.18-srcUpgrade golang-1.17Upgrade golang-1.17-srcUpgrade golang-1.18Upgrade golang-1.18-goUpgrade golang-1.18 (Ubuntu Pro)Upgrade golang-1.18-go (Ubuntu Pro)Upgrade golang-1.17-goUpgrade golang-1.18-src (Ubuntu Pro) | Oct 11, 2024 | Jun 8, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 8, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub