Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cmd/go: line directives allows arbitrary execution during build (CVE-2023-39323) #1184

Closed
eks-distro-pr-bot opened this issue Oct 5, 2023 · 2 comments
Labels
external go Pull requests that update Go code golang on-call security

Comments

@eks-distro-pr-bot
Copy link
Contributor

"//line" directives can be used to bypass the restrictions on "//go:cgo_"
directives, allowing blocked linker and compiler flags to be passed during
compilation. This can result in unexpected execution of arbitrary code when
running "go build". The line directive requires the absolute path of the file in
which the directive lives, which makes exploting this issue significantly more
complex.

This is CVE-2023-39323 and Go issue https://go.dev/issue/63211.


This is a PRIVATE issue for CVE-2023-39323, tracked in http://b/296358534 and fixed by http://tg/2032884.

/cc @golang/security and @golang/release

@rcrozean
Copy link
Member

rcrozean commented Oct 5, 2023

#1182

@rcrozean rcrozean added security golang go Pull requests that update Go code on-call external labels Oct 5, 2023
@rcrozean
Copy link
Member

Backported to 1.19.13 in #1192

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
external go Pull requests that update Go code golang on-call security
Projects
None yet
Development

No branches or pull requests

2 participants