Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cmd/go: improper sanitization of LDFLAGS [CVE-2023-29405] [1.19 backport] #60513

Closed
gopherbot opened this issue May 30, 2023 · 4 comments
Closed

cmd/go: improper sanitization of LDFLAGS [CVE-2023-29405] [1.19 backport] #60513

gopherbot opened this issue May 30, 2023 · 4 comments
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge release-blocker Security
Milestone
Go1.19.10

Comments

@gopherbot
Copy link
Contributor

@rolandshoemaker requested issue #60306 to be considered for backport to the next 1.19 minor release.

@gopherbot please open backport issues.
@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label May 30, 2023
@gopherbot gopherbot mentioned this issue May 30, 2023
Closed
@gopherbot gopherbot added this to the Go1.19.10 milestone May 30, 2023
@dr2chase dr2chase added the CherryPickApproved Used during the release process for point releases label Jun 6, 2023
@gopherbot gopherbot removed the CherryPickCandidate Used during the release process for point releases label Jun 6, 2023
@gopherbot
Copy link
Contributor Author

Change https://go.dev/cl/501216 mentions this issue: [release-branch.go1.19] cmd/go,cmd/cgo: in _cgo_flags use one line per flag

gopherbot pushed a commit that referenced this issue Jun 6, 2023
@ianlancetaylor @gopherbot
[release-branch.go1.19] cmd/go,cmd/cgo: in _cgo_flags use one line pe…
44e0fb1 
…r flag

The flags that we recorded in _cgo_flags did not use any quoting,
so a flag containing embedded spaces was mishandled.
Change the _cgo_flags format to put each flag on a separate line.
That is a simple format that does not require any quoting.

As far as I can tell only cmd/go uses _cgo_flags, and it is only
used for gccgo. If this patch doesn't cause any trouble, then
in the next release we can change to only using _cgo_flags for gccgo.

Thanks to Juho Nurminen of Mattermost for reporting this issue.

Updates #60306
Fixes #60513
Fixes CVE-2023-29405

Change-Id: Id738a737ecae47babb34c4b4fc4d65336cf0c0f3
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1875094
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Roland Shoemaker <bracewell@google.com>
(cherry picked from commit bcdfcadd5612212089d958bc352a6f6c90742dcc)
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1902227
Run-TryBot: Roland Shoemaker <bracewell@google.com>
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1904341
Reviewed-by: Michael Knyszek <mknyszek@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/501216
Auto-Submit: Michael Knyszek <mknyszek@google.com>
Run-TryBot: David Chase <drchase@google.com>
TryBot-Bypass: David Chase <drchase@google.com>
@gopherbot
Copy link
Contributor Author

Closed by merging 44e0fb1 to release-branch.go1.19.

@dr2chase dr2chase changed the title security: fix CVE-2023-29405 [1.19 backport] cmd/go: improper sanitization of LDFLAGS [CVE-2023-29405] [1.19 backport] Jun 6, 2023
@gopherbot
Copy link
Contributor Author

Change https://go.dev/cl/501297 mentions this issue: [release-branch.go1.19] cmd/cgo: correct _cgo_flags output

gopherbot pushed a commit that referenced this issue Jun 6, 2023
@ianlancetaylor
[release-branch.go1.19] cmd/cgo: correct _cgo_flags output
3ba9c89 
For #60306
For #60513

Change-Id: I8b37d74433456f3270c2ea465ecf406da6e5a578
Reviewed-on: https://go-review.googlesource.com/c/go/+/501297
Run-TryBot: Ian Lance Taylor <iant@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: David Chase <drchase@google.com>
TryBot-Bypass: Dmitri Shuralyov <dmitshur@golang.org>
@gopherbot
Copy link
Contributor Author

Change https://go.dev/cl/505596 mentions this issue: [release-branch.go1.19] cmd/go: skip TestScript/gccgo_link_ldflags on aix/ppc64

gopherbot pushed a commit that referenced this issue Jun 24, 2023
@cuonglm @gopherbot
[release-branch.go1.19] cmd/go: skip TestScript/gccgo_link_ldflags on…
9a2e6c9 
… aix/ppc64

The gccgo on the builder is not updated to support runtime/cgo

For #60306.
For #60513.

Change-Id: If0fb1ccdf589cc9741f6a065bacfa4f06e64ec15
Reviewed-on: https://go-review.googlesource.com/c/go/+/501435
Reviewed-by: Ian Lance Taylor <iant@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Cuong Manh Le <cuong.manhle.vn@gmail.com>
Reviewed-by: Benny Siegert <bsiegert@gmail.com>
Auto-Submit: Cuong Manh Le <cuong.manhle.vn@gmail.com>
(cherry picked from commit 688d75b)
Reviewed-on: https://go-review.googlesource.com/c/go/+/505596
Auto-Submit: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Than McIntosh <thanm@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org>
@golang golang locked and limited conversation to collaborators Jun 22, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge release-blocker Security
Projects
None yet
Milestone
Go1.19.10
Development

No branches or pull requests
4 participants
@mknyszek @dmitshur @dr2chase @gopherbot