os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows

[neild]

OpenFile behaves inconsistently on Unix and Windows when passed the O_CREATE|O_EXCL flags and the target of the operation is a dangling symlink.

On Unix systems, creating the file fails. From Linux's open(2) manpage:

When [O_CREAT and O_EXCL] are specified, symbolic links are not followed: if pathname is a symbolic link, then open() fails regardless of where the symbolic link points.

On Windows, OpenFile creates a file in the location referenced by the link.

Example test (passes on Unix systems, fails on Windows):

func TestOpenFileCreateExclDanglingSymlink(t *testing.T) {
        dir := t.TempDir()
        link := filepath.Join(dir, "link")
        if err := os.Symlink("does_not_exist", link); err != nil {
                t.Fatal(err)
        }
        f, err := os.OpenFile(link, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o666)
        if err == nil {
                f.Close()
                t.Errorf("OpenFile of a dangling symlink with O_CREATE|O_EXCL succeeded: want error")
        }
}

We have decided to categorize this as a PUBLIC track security vulnerability. This is CVE-2025-0913.

Thanks to Junyoung Park and Dong-uk Kim of KAIST Hacking Lab for discovering this issue.

[gopherbot]

Change https://go.dev/cl/672396 mentions this issue: os: don't follow symlinks on Windows when O_CREATE|O_EXCL

[neild]

@gopherbot please open backport issues for this PUBLIC track vulnerability.

[gopherbot]

Backport issue(s) opened: #73719 (for 1.23), #73720 (for 1.24).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[qmuntal]

@neild https://go.dev/cl/672396 missed the case where the perm parameter in syscall.Open contains S_IWRITE, in which case the attributes are overwritten with just FILE_ATTRIBUTE_READONLY:

go/src/syscall/syscall_windows.go

Lines 406 to 418 in bb0c14b

	var attrs uint32 = FILE_ATTRIBUTE_NORMAL
	switch {
	case flag&(O_CREAT|O_EXCL) == (O_CREAT | O_EXCL):
	createmode = CREATE_NEW
	attrs |= FILE_FLAG_OPEN_REPARSE_POINT // don't follow symlinks
	case flag&O_CREAT == O_CREAT:
	createmode = OPEN_ALWAYS
	default:
	createmode = OPEN_EXISTING
	}
	if perm&S_IWRITE == 0 {
	attrs = FILE_ATTRIBUTE_READONLY
	}

[tareksha]

hi @neild, can this issue be considered specific to windows os only?

[gopherbot]

Change https://go.dev/cl/676655 mentions this issue: os: don't follow symlinks on Windows when O_CREATE|O_EXCL and read-only