From 5e1ad12db93611b13d2be176fdc276330dc52b98 Mon Sep 17 00:00:00 2001 From: Neal Patel Date: Thu, 4 Dec 2025 12:30:39 -0500 Subject: [PATCH] cmd/go/internal/work: sanitize flags before invoking 'pkg-config' The addition of CgoPkgConfig allowed execution with flags not matching the safelist. In order to prevent potential arbitrary code execution at build time, ensure that flags are validated prior to invoking the 'pkg-config' binary. Thank you to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue. Fixes CVE-2025-61731 Fixes #77100 Change-Id: Ic51b41f1f7e697ab98c9c32c6fae35f217f7f364 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3240 Reviewed-by: Nicholas Husin Reviewed-by: Damien Neil Reviewed-on: https://go-review.googlesource.com/c/go/+/736711 Reviewed-by: Junyang Shao Auto-Submit: Michael Pratt LUCI-TryBot-Result: Go LUCI --- src/cmd/go/internal/work/exec.go | 8 ++++++++ src/cmd/go/internal/work/security.go | 1 + 2 files changed, 9 insertions(+) diff --git a/src/cmd/go/internal/work/exec.go b/src/cmd/go/internal/work/exec.go index 0afdce2356..c497135612 100644 --- a/src/cmd/go/internal/work/exec.go +++ b/src/cmd/go/internal/work/exec.go @@ -1788,6 +1788,14 @@ func (b *Builder) getPkgConfigFlags(a *Action, p *load.Package) (cflags, ldflags return nil, nil, fmt.Errorf("invalid pkg-config package name: %s", pkg) } } + + // Running 'pkg-config' can cause execution of + // arbitrary code using flags that are not in + // the safelist. + if err := checkCompilerFlags("CFLAGS", "pkg-config --cflags", pcflags); err != nil { + return nil, nil, err + } + var out []byte out, err = sh.runOut(p.Dir, nil, b.PkgconfigCmd(), "--cflags", pcflags, "--", pkgs) if err != nil { diff --git a/src/cmd/go/internal/work/security.go b/src/cmd/go/internal/work/security.go index ffa83e0591..80b3f8797c 100644 --- a/src/cmd/go/internal/work/security.go +++ b/src/cmd/go/internal/work/security.go @@ -129,6 +129,7 @@ var validCompilerFlags = []*lazyregexp.Regexp{ re(`-pedantic(-errors)?`), re(`-pipe`), re(`-pthread`), + re(`--static`), re(`-?-std=([^@\-].*)`), re(`-?-stdlib=([^@\-].*)`), re(`--sysroot=([^@\-].*)`), -- 2.52.0