VYPR
← All advisories
Medium severity6.4NVD Advisory· Published May 8, 2024· Updated Apr 15, 2026

CVE-2024-24787

CVE-2024-24787

Description

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

On macOS, building a Go module that uses CGo with a malicious #cgo LDFLAGS directive can lead to arbitrary code execution via the Apple linker's -lto_library flag.

Vulnerability

Overview

CVE-2024-24787 is a vulnerability in Go's cmd/go tool affecting Darwin (macOS) systems. When building a Go module that contains CGo code, the build process passes flags from #cgo LDFLAGS directives to the Apple linker (ld). The linker interprets the -lto_library flag, which can specify an arbitrary library path. By embedding a crafted -lto_library directive in a CGo source file, an attacker can cause the linker to load a malicious library at build time, resulting in arbitrary code execution on the build host [1][3][4].

Attack

Vector and Prerequisites

Exploitation requires the attacker to supply a malicious Go module (or convince a developer to build such a module) that includes CGo code with a malicious #cgo LDFLAGS directive. The target must build the module on a macOS system that uses Apple's linker. No special privileges beyond the ability to initiate a Go build are needed; the code execution occurs during the normal build process. The vulnerability is triggered via the -lto_library flag, which is not sanitized by the Go toolchain [2].

Impact

A successful attack achieves arbitrary code execution in the context of the user running the go build command. This can lead to full compromise of the developer's machine, including theft of credentials, source code, or installation of persistent backdoors. The attack does not require any user interaction beyond building the Go module, making it particularly dangerous in supply-chain scenarios where developers build third-party packages [1][3].

Mitigation and

Status

Go patched this vulnerability in versions 1.22.3 and 1.21.10, released on May 8, 2024. Users are advised to update their Go toolchains immediately. There is no known workaround for earlier versions other than avoiding building untrusted CGo modules on macOS. The issue was reported by Juho Forsén of Mattermost [1][3][4].

References
  1. security - [security] Go 1.22.3 and Go 1.21.10 are released
  2. GO-2024-2825 - Go Packages
  3. [security] Go 1.22.3 and Go 1.21.10 are released
  4. cmd/go: arbitrary code execution during build on darwin (CVE-2024-24787)

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

1288

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.