Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cmd/go: improper sanitization of LDFLAGS [CVE-2023-29404] [1.20 backport] #60512

Closed
gopherbot opened this issue May 30, 2023 · 2 comments
Closed

cmd/go: improper sanitization of LDFLAGS [CVE-2023-29404] [1.20 backport] #60512

gopherbot opened this issue May 30, 2023 · 2 comments
Labels
CherryPickApproved Used during the release process for point releases release-blocker Security
Milestone
Go1.20.5

Comments

@gopherbot
Copy link

@rolandshoemaker requested issue #60305 to be considered for backport to the next 1.20 minor release.

@gopherbot please open backport issues.
@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label May 30, 2023
@gopherbot gopherbot mentioned this issue May 30, 2023
Closed
@gopherbot gopherbot added this to the Go1.20.5 milestone May 30, 2023
@dr2chase dr2chase added the CherryPickApproved Used during the release process for point releases label Jun 6, 2023
@gopherbot gopherbot removed the CherryPickCandidate Used during the release process for point releases label Jun 6, 2023
@gopherbot
Copy link
Author

Change https://go.dev/cl/501221 mentions this issue: [release-branch.go1.20] cmd/go: enforce flags with non-optional arguments

gopherbot pushed a commit that referenced this issue Jun 6, 2023
@rolandshoemaker @gopherbot
[release-branch.go1.20] cmd/go: enforce flags with non-optional argum…
356a419 
…ents

Enforce that linker flags which expect arguments get them, otherwise it
may be possible to smuggle unexpected flags through as the linker can
consume what looks like a flag as an argument to a preceding flag (i.e.
"-Wl,-O -Wl,-R,-bad-flag" is interpreted as "-O=-R -bad-flag"). Also be
somewhat more restrictive in the general format of some flags.

Thanks to Juho Nurminen of Mattermost for reporting this issue.

Updates #60305
Fixes #60512
Fixes CVE-2023-29404

Change-Id: I5989f68d21a8851d8edd47f08550850524ee9180
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1876275
Reviewed-by: Ian Lance Taylor <iant@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
(cherry picked from commit 896779503cf754cbdac24b61d4cc953b50fe2dde)
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1902226
TryBot-Result: Security TryBots <security-trybots@go-security-trybots.iam.gserviceaccount.com>
Run-TryBot: Roland Shoemaker <bracewell@google.com>
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1904346
Reviewed-by: Michael Knyszek <mknyszek@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/501221
Run-TryBot: David Chase <drchase@google.com>
Auto-Submit: Michael Knyszek <mknyszek@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
@gopherbot
Copy link
Author

Closed by merging 356a419 to release-branch.go1.20.

@dr2chase dr2chase changed the title security: fix CVE-2023-29404 [1.20 backport] cmd/go: improper sanitization of LDFLAGS [CVE-2023-29404] [1.20 backport] Jun 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
CherryPickApproved Used during the release process for point releases release-blocker Security
Projects
None yet
Milestone
Go1.20.5
Development

No branches or pull requests
4 participants
@mknyszek @dmitshur @dr2chase @gopherbot