[release-branch.go1.25] cmd/go/internal/work: sanitize flags before invoking 'pkg...

The addition of CgoPkgConfig allowed execution with flags not
matching the safelist. In order to prevent potential arbitrary
code execution at build time, ensure that flags are validated
prior to invoking the 'pkg-config' binary.

Thank you to RyotaK (https://ryotak.net) of GMO Flatt Security Inc.
for reporting this issue.

Fixes CVE-2025-61731
Fixes #77100

Change-Id: Ic51b41f1f7e697ab98c9c32c6fae35f217f7f364
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3240
Reviewed-by: Nicholas Husin <husin@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3343
Reviewed-by: Neal Patel <nealpatel@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/736722
TryBot-Bypass: Michael Pratt <mpratt@google.com>
Auto-Submit: Michael Pratt <mpratt@google.com>
Reviewed-by: Junyang Shao <shaojunyang@google.com>

diff --git a/src/cmd/go/internal/work/exec.go b/src/cmd/go/internal/work/exec.go
index 63fd13f7544db3ed9f3bf3b89956f69d9a5878f5..9d4429a51c2cb7aa8f890b5281a65ab6b8088b8a 100644 (file)
--- a/src/cmd/go/internal/work/exec.go
+++ b/src/cmd/go/internal/work/exec.go
@@ -1636,6 +1636,14 @@ func (b *Builder) getPkgConfigFlags(a *Action) (cflags, ldflags []string, err er
                                return nil, nil, fmt.Errorf("invalid pkg-config package name: %s", pkg)
                        }
                }
+
+               // Running 'pkg-config' can cause execution of
+               // arbitrary code using flags that are not in
+               // the safelist.
+               if err := checkCompilerFlags("CFLAGS", "pkg-config --cflags", pcflags); err != nil {
+                       return nil, nil, err
+               }
+
                var out []byte
                out, err = sh.runOut(p.Dir, nil, b.PkgconfigCmd(), "--cflags", pcflags, "--", pkgs)
                if err != nil {

diff --git a/src/cmd/go/internal/work/security.go b/src/cmd/go/internal/work/security.go
index 3b3eba536cb146091082e053df9fad49c4bf917e..68d2706051b08bc9654315cfc5d320e8aac2e6b0 100644 (file)
--- a/src/cmd/go/internal/work/security.go
+++ b/src/cmd/go/internal/work/security.go
@@ -130,6 +130,7 @@ var validCompilerFlags = []*lazyregexp.Regexp{
        re(`-pedantic(-errors)?`),
        re(`-pipe`),
        re(`-pthread`),
+       re(`--static`),
        re(`-?-std=([^@\-].*)`),
        re(`-?-stdlib=([^@\-].*)`),
        re(`--sysroot=([^@\-].*)`),