cmd/go: arbitrary code execution during build on darwin (CVE-2024-24787) #67119
Description
On Darwin, building a Go module which contains CGO can trigger arbitrary code
execution when using the Apple version of ld, due to usage of the -lto_library
flag in a "#cgo LDFLAGS" directive.
Thanks to Juho Forsén of Mattermost for reporting this issue.
This is CVE-2024-24787.
This is a PRIVATE issue for CVE-2024-24787, tracked in http://b/335700829.
/cc @golang/security and @golang/release