On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golangUpgrade golang-srcUpgrade golang-docsUpgrade golang-binUpgrade go-toolsetUpgrade golang-testsUpgrade golang-raceUpgrade golang-miscUpgrade delve | Jun 30, 2023 | Jun 8, 2023 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Jun 8, 2023 |
| Amazon Linux Ami 2 | — | Upgrade containerd-stressUpgrade golang-raceUpgrade golangUpgrade golang-sharedUpgrade containerd-debuginfoUpgrade golang-docsUpgrade golang-testsUpgrade golang-binUpgrade golang-srcUpgrade containerdUpgrade golang-misc | Jul 27, 2023 | Jun 8, 2023 |
| Amazon_linux | — | Upgrade golang | Oct 7, 2023 | Jun 8, 2023 |
| Amazon_linux_2023 | — | Upgrade containerd-stress-debuginfoUpgrade containerd-debugsourceUpgrade containerd-debuginfoUpgrade golang-srcUpgrade golang-sharedUpgrade containerdUpgrade containerd-stressUpgrade golang-testsUpgrade golang-binUpgrade golangUpgrade golang-miscUpgrade golang-docs | Feb 17, 2025 | Jun 8, 2023 |
| Centos_linux | — | Upgrade golang-binUpgrade golang-testsUpgrade delve-debugsourceUpgrade delveUpgrade golang-docsUpgrade golang-raceUpgrade golang-miscUpgrade go-toolsetUpgrade golang-srcUpgrade delve-debuginfoUpgrade golang | Jun 30, 2023 | Jun 8, 2023 |
| Debian | — | No solution exists | May 15, 2025 | Jun 8, 2023 |
| Freebsd | — | Upgrade go120Upgrade go119 | Aug 3, 2023 | Aug 2, 2023 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Jun 8, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Jan 10, 2024 | Jun 8, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Jan 10, 2024 | Jun 8, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Mar 18, 2025 | Jun 8, 2023 |
| Oracle_linux | — | Upgrade golang-miscUpgrade golangUpgrade golang-binUpgrade golang-srcUpgrade go-toolsetUpgrade delveUpgrade golang-raceUpgrade golang-docsUpgrade golang-tests | Jul 5, 2023 | Jun 8, 2023 |
| Redhat_linux | — | Upgrade golang-testsUpgrade golangUpgrade golang-raceUpgrade delve-debugsourceUpgrade golang-srcUpgrade golang-miscUpgrade delve-debuginfoUpgrade delveUpgrade golang-binUpgrade golang-docsUpgrade go-toolset | Jun 30, 2023 | Jun 8, 2023 |
| Rocky_linux | — | Upgrade golang-raceUpgrade golang-binUpgrade golangUpgrade go-toolset | Mar 5, 2024 | Jun 8, 2023 |
| Suse | — | Upgrade go1.20-raceUpgrade go1.19-docUpgrade go1.20Upgrade go1.19-raceUpgrade go1.20-docUpgrade go1.19 | Jun 19, 2023 | Jun 8, 2023 |
| Ubuntu | — | Upgrade golang-1.18-go (Ubuntu Pro)Upgrade golang-1.17-goUpgrade golang-1.18-src (Ubuntu Pro)Upgrade golang-1.18-srcUpgrade golang-1.18 (Ubuntu Pro)Upgrade golang-1.17-srcUpgrade golang-1.17Upgrade golang-1.18-goUpgrade golang-1.18 | Oct 11, 2024 | Jun 8, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 8, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub