]> Cypherpunks repositories - gostls13.git/commit
cmd/go: disallow -lto_library in LDFLAGS
authorRoland Shoemaker <bracewell@google.com>
Thu, 25 Apr 2024 20:09:54 +0000 (13:09 -0700)
committerCherry Mui <cherryyz@google.com>
Tue, 7 May 2024 15:41:16 +0000 (15:41 +0000)
commit348b23830d82aece5775eb9f7f3b3587cf5300c6
treeac9b4f526d37561baeb0717e7101f1cd152cfcbe
parent38ee0c7630e999f97d96899ecf4e8d0230236cd6
cmd/go: disallow -lto_library in LDFLAGS

The darwin linker allows setting the LTO library with the -lto_library
flag. This wasn't caught by our "safe linker flags" check because it
was covered by the -lx flag used for linking libraries. This change
adds a specific check for excluded flags which otherwise satisfy our
existing checks.

Loading a mallicious LTO library would allow an attacker to cause the
linker to execute abritrary code when "go build" was called.

Thanks to Juho Forsén of Mattermost for reporting this issue.

Fixes #67119
Fixes CVE-2024-24787

Change-Id: I77ac8585efbdbdfd5f39c39ed623b9408a0f9eaf
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1380
Reviewed-by: Russ Cox <rsc@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/583815
Reviewed-by: David Chase <drchase@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
src/cmd/go/internal/work/security.go
src/cmd/go/testdata/script/darwin_lto_library_ldflag.txt [new file with mode: 0644]