[release-branch.go1.24] cmd/go/internal/work: sanitize flags before invoking 'pkg...

The addition of CgoPkgConfig allowed execution with flags not
matching the safelist. In order to prevent potential arbitrary
code execution at build time, ensure that flags are validated
prior to invoking the 'pkg-config' binary.

Thank you to RyotaK (https://ryotak.net) of GMO Flatt Security Inc.
for reporting this issue.

Fixes CVE-2025-61731
Fixes #77100

Change-Id: Ic51b41f1f7e697ab98c9c32c6fae35f217f7f364
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3240
Reviewed-by: Nicholas Husin <husin@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3344
Reviewed-by: Neal Patel <nealpatel@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/736701
Auto-Submit: Michael Pratt <mpratt@google.com>
TryBot-Bypass: Michael Pratt <mpratt@google.com>
Reviewed-by: Junyang Shao <shaojunyang@google.com>

diff --git a/src/cmd/go/internal/work/exec.go b/src/cmd/go/internal/work/exec.go
index 7b073165d5fe2540f10a77c1f7050c145aa18356..8d0a7b51c21f47fccd025c2b9376b6ed194f987b 100644 (file)
--- a/src/cmd/go/internal/work/exec.go
+++ b/src/cmd/go/internal/work/exec.go
@@ -1652,6 +1652,14 @@ func (b *Builder) getPkgConfigFlags(a *Action) (cflags, ldflags []string, err er
                                return nil, nil, fmt.Errorf("invalid pkg-config package name: %s", pkg)
                        }
                }
+
+               // Running 'pkg-config' can cause execution of
+               // arbitrary code using flags that are not in
+               // the safelist.
+               if err := checkCompilerFlags("CFLAGS", "pkg-config --cflags", pcflags); err != nil {
+                       return nil, nil, err
+               }
+
                var out []byte
                out, err = sh.runOut(p.Dir, nil, b.PkgconfigCmd(), "--cflags", pcflags, "--", pkgs)
                if err != nil {

diff --git a/src/cmd/go/internal/work/security.go b/src/cmd/go/internal/work/security.go
index 50bfd0ab70538330ecaf7491f30bb497ff420673..66b02cb8592a918bd370b3680eb361e73679c97f 100644 (file)
--- a/src/cmd/go/internal/work/security.go
+++ b/src/cmd/go/internal/work/security.go
@@ -125,6 +125,7 @@ var validCompilerFlags = []*lazyregexp.Regexp{
        re(`-pedantic(-errors)?`),
        re(`-pipe`),
        re(`-pthread`),
+       re(`--static`),
        re(`-?-std=([^@\-].*)`),
        re(`-?-stdlib=([^@\-].*)`),
        re(`--sysroot=([^@\-].*)`),