CVE-2024-24787: 
Go vulnerability analysis and mitigation

CVE-2024-24787 is a security vulnerability discovered in the Go programming language that affects Darwin (macOS) systems. The vulnerability was identified in Go versions prior to 1.21.10 and versions from 1.22.0-0 before 1.22.3. The issue occurs when building a Go module containing CGO (Go's foreign function interface for C code) on Darwin systems using Apple's version of the linker (ld), specifically related to the usage of the -lto_library flag in a "#cgo LDFLAGS" directive (Go Announce, Go Packages).

The vulnerability stems from the improper handling of the -lto_library flag in the "#cgo LDFLAGS" directive when using Apple's version of the linker. This flag was previously unchecked by Go's "safe linker flags" verification system due to its similarity to the benign -lx flag used for linking libraries. The vulnerability has received a CVSS score of 9.8 (CRITICAL) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NetApp Security).

Successful exploitation of this vulnerability could lead to arbitrary code execution during the build process when using the go build command. An attacker could potentially load a malicious LTO library, resulting in unauthorized code execution with the privileges of the user running the build process (Security Online).

The vulnerability is exploitable during the build process of Go modules containing CGO on Darwin systems. A proof-of-concept was published on May 10, 2024, increasing the likelihood of exploitation in the wild (Security Online).

The vulnerability has been patched in Go versions 1.22.3 and 1.21.10. Users are strongly advised to upgrade to these versions or later. The fix can be obtained by either downloading the binary and source distributions from the Go website or by using git checkout go1.22.3 for those compiling from source (Go Announce).

The vulnerability was responsibly disclosed by Juho Forsén of Mattermost, and the Go team promptly addressed the issue with security patches. The Go team announced the fixes through their official announcement channels, demonstrating their commitment to security (Go Announce).