]> Cypherpunks repositories - gostls13.git/commit
runtime: safely load DLLs
authorJason A. Donenfeld <Jason@zx2c4.com>
Wed, 6 Mar 2019 18:26:29 +0000 (19:26 +0100)
committerAlex Brainman <alex.brainman@gmail.com>
Sun, 10 Mar 2019 05:40:13 +0000 (05:40 +0000)
commit9b6e9f0c8c66355c0f0575d808b32f52c8c6d21c
tree4b143b84ee9ad075e6342094ee262e7dcc748a42
parent243c8eb8c290ebbf2e2811da2dd7538200dde6b3
runtime: safely load DLLs

While many other call sites have been moved to using the proper
higher-level system loading, these areas were left out. This prevents
DLL directory injection attacks. This includes both the runtime load
calls (using LoadLibrary prior) and the implicitly linked ones via
cgo_import_dynamic, which we move to our LoadLibraryEx. The goal is to
only loosely load kernel32.dll and strictly load all others.

Meanwhile we make sure that we never fallback to insecure loading on
older or unpatched systems.

This is CVE-2019-9634.

Fixes #14959
Fixes #28978
Fixes #30642

Change-Id: I401a13ed8db248ab1bb5039bf2d31915cac72b93
Reviewed-on: https://go-review.googlesource.com/c/go/+/165798
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
src/runtime/os_windows.go
src/runtime/syscall_windows.go
src/syscall/dll_windows.go
src/syscall/security_windows.go
src/syscall/zsyscall_windows.go