packages/golang
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!213 cvefix: CVE-2023-29402,CVE-2023-29404,CVE-2023-29405,CVE-2023-29403

Browse Source 
From: @hcnbxx 
Reviewed-by: @zhangsong234, @jing-rui 
Signed-off-by: @jing-rui
This commit is contained in:
openeuler-ci-bot 2023-06-29 01:22:10 +00:00 committed by Gitee
commit 65aa6f00de
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
5 changed files with 2005 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

202
0099-Backport-cmd-go-disallow-package-directories-contain.patch Normal file
View File

@ -0,0 +1,202 @@
From f47e163b52e1987771c9165616cfedda9ea35fee Mon Sep 17 00:00:00 2001
From: "Bryan C. Mills" <bcmills@google.com>
Date: Sat, 13 May 2023 02:15:16 +0800
Subject: [PATCH 1/3] [Backport] cmd/go: disallow package directories
containing newlines
Offering: Cloud Core Network
CVE: CVE-2023-29402
Reference: https://go-review.googlesource.com/c/go/+/501218
Directory or file paths containing newlines may cause tools (such as
cmd/cgo) that emit "//line" or "#line" -directives to write part of
the path into non-comment lines in generated source code. If those
lines contain valid Go code, it may be injected into the resulting
binary.
(Note that Go import paths and file paths within module zip files
already could not contain newlines.)
Thanks to Juho Nurminen of Mattermost for reporting this issue.
Updates #60167.
Fixes #60515.
Fixes CVE-2023-29402.
Change-Id: If55d0400c02beb7a5da5eceac60f1abeac99f064
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1882606
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Run-TryBot: Roland Shoemaker <bracewell@google.com>
Reviewed-by: Russ Cox <rsc@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
(cherry picked from commit 41f9046495564fc728d6f98384ab7276450ac7e2)
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1902229
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1904343
Reviewed-by: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Bryan Mills <bcmills@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/501218
Run-TryBot: David Chase <drchase@google.com>
Auto-Submit: Michael Knyszek <mknyszek@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Signed-off-by: Tang Xi tangxi6@huawei.com
---
src/cmd/go/internal/load/pkg.go | 4 +
src/cmd/go/internal/work/exec.go | 6 ++
src/cmd/go/script_test.go | 1 +
.../go/testdata/script/build_cwd_newline.txt | 100 ++++++++++++++++++
4 files changed, 111 insertions(+)
create mode 100644 src/cmd/go/testdata/script/build_cwd_newline.txt
diff --git a/src/cmd/go/internal/load/pkg.go b/src/cmd/go/internal/load/pkg.go
index 2b5fbb1c5b..07795a4c70 100644
--- a/src/cmd/go/internal/load/pkg.go
+++ b/src/cmd/go/internal/load/pkg.go
@@ -1791,6 +1791,10 @@ func (p *Package) load(path string, stk *ImportStack, importPos []token.Position
setError(fmt.Errorf("invalid input directory name %q", name))
return
}
+ if strings.ContainsAny(p.Dir, "\r\n") {
+ setError(fmt.Errorf("invalid package directory %q", p.Dir))
+ return
+ }
// Build list of imported packages and full dependency list.
imports := make([]*Package, 0, len(p.Imports))
diff --git a/src/cmd/go/internal/work/exec.go b/src/cmd/go/internal/work/exec.go
index eb1efd9f82..3745c688cb 100644
--- a/src/cmd/go/internal/work/exec.go
+++ b/src/cmd/go/internal/work/exec.go
@@ -457,6 +457,12 @@ func (b *Builder) build(a *Action) (err error) {
b.Print(a.Package.ImportPath + "\n")
}
+ if p.Error != nil {
+ // Don't try to build anything for packages with errors. There may be a
+ // problem with the inputs that makes the package unsafe to build.
+ return p.Error
+ }
+
if a.Package.BinaryOnly {
p.Stale = true
p.StaleReason = "binary-only packages are no longer supported"
diff --git a/src/cmd/go/script_test.go b/src/cmd/go/script_test.go
index 2e8f18a897..5c2a8d1409 100644
--- a/src/cmd/go/script_test.go
+++ b/src/cmd/go/script_test.go
@@ -140,6 +140,7 @@ func (ts *testScript) setup() {
"devnull=" + os.DevNull,
"goversion=" + goVersion(ts),
":=" + string(os.PathListSeparator),
+ "newline=\n",
}
if runtime.GOOS == "plan9" {
diff --git a/src/cmd/go/testdata/script/build_cwd_newline.txt b/src/cmd/go/testdata/script/build_cwd_newline.txt
new file mode 100644
index 0000000000..61c6966b02
--- /dev/null
+++ b/src/cmd/go/testdata/script/build_cwd_newline.txt
@@ -0,0 +1,100 @@
+[windows] skip 'filesystem normalizes / to \'
+[plan9] skip 'filesystem disallows \n in paths'
+
+# If the directory path containing a package to be built includes a newline,
+# the go command should refuse to even try to build the package.
+
+env DIR=$WORK${/}${newline}'package main'${newline}'func main() { panic("uh-oh")'${newline}'/*'
+
+mkdir $DIR
+cd $DIR
+exec pwd
+cp $WORK/go.mod ./go.mod
+cp $WORK/main.go ./main.go
+cp $WORK/main_test.go ./main_test.go
+
+! go build -o $devnull .
+stderr 'package example: invalid package directory .*uh-oh'
+
+! go build -o $devnull main.go
+stderr 'package command-line-arguments: invalid package directory .*uh-oh'
+
+! go run .
+stderr 'package example: invalid package directory .*uh-oh'
+
+! go run main.go
+stderr 'package command-line-arguments: invalid package directory .*uh-oh'
+
+! go test .
+stderr 'package example: invalid package directory .*uh-oh'
+
+! go test -v main.go main_test.go
+stderr 'package command-line-arguments: invalid package directory .*uh-oh'
+
+
+# Since we do preserve $PWD (or set it appropriately) for commands, and we do
+# not resolve symlinks unnecessarily, referring to the contents of the unsafe
+# directory via a safe symlink should be ok, and should not inject the data from
+# the symlink target path.
+
+[!symlink] stop 'remainder of test checks symlink behavior'
+[short] stop 'links and runs binaries'
+
+symlink $WORK${/}link -> $DIR
+
+go run $WORK${/}link${/}main.go
+! stdout panic
+! stderr panic
+stderr '^ok$'
+
+go test -v $WORK${/}link${/}main.go $WORK${/}link${/}main_test.go
+! stdout panic
+! stderr panic
+stdout '^ok$' # 'go test' combines the test's stdout into stderr
+
+cd $WORK/link
+
+! go run $DIR${/}main.go
+stderr 'package command-line-arguments: invalid package directory .*uh-oh'
+
+go run .
+! stdout panic
+! stderr panic
+stderr '^ok$'
+
+go run main.go
+! stdout panic
+! stderr panic
+stderr '^ok$'
+
+go test -v
+! stdout panic
+! stderr panic
+stdout '^ok$' # 'go test' combines the test's stdout into stderr
+
+go test -v .
+! stdout panic
+! stderr panic
+stdout '^ok$' # 'go test' combines the test's stdout into stderr
+
+
+-- $WORK/go.mod --
+module example
+go 1.19
+-- $WORK/main.go --
+package main
+
+import "C"
+
+func main() {
+ /* nothing here */
+ println("ok")
+}
+-- $WORK/main_test.go --
+package main
+
+import "testing"
+
+func TestMain(*testing.M) {
+ main()
+}
--
2.33.0

86
0100-Backport-cmd-go-enforce-flags-with-non-optional-argu.patch Normal file
View File

@ -0,0 +1,86 @@
From 74a03ac220bb428161dcf4542a0298f367de1138 Mon Sep 17 00:00:00 2001
From: Roland Shoemaker <bracewell@google.com>
Date: Fri, 5 May 2023 13:10:34 -0700
Subject: [PATCH 2/3] [Backport] cmd/go: enforce flags with non-optional
arguments
Offering: Cloud Core Network
CVE: CVE-2023-29404
Reference: https://go-review.googlesource.com/c/go/+/501217
Enforce that linker flags which expect arguments get them, otherwise it
may be possible to smuggle unexpected flags through as the linker can
consume what looks like a flag as an argument to a preceding flag (i.e.
"-Wl,-O -Wl,-R,-bad-flag" is interpreted as "-O=-R -bad-flag"). Also be
somewhat more restrictive in the general format of some flags.
Thanks to Juho Nurminen of Mattermost for reporting this issue.
Updates #60305
Fixes #60511
Fixes CVE-2023-29404
Change-Id: Icdffef2c0f644da50261cace6f43742783931cff
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1876275
Reviewed-by: Ian Lance Taylor <iant@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
(cherry picked from commit 896779503cf754cbdac24b61d4cc953b50fe2dde)
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1902225
Run-TryBot: Roland Shoemaker <bracewell@google.com>
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1904342
Reviewed-by: Michael Knyszek <mknyszek@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/501217
Auto-Submit: Michael Knyszek <mknyszek@google.com>
Run-TryBot: David Chase <drchase@google.com>
TryBot-Bypass: Michael Knyszek <mknyszek@google.com>
Signed-off-by: Tang Xi tangxi6@huawei.com
---
src/cmd/go/internal/work/security.go | 6 +++---
src/cmd/go/internal/work/security_test.go | 5 +++++
2 files changed, 8 insertions(+), 3 deletions(-)
diff --git a/src/cmd/go/internal/work/security.go b/src/cmd/go/internal/work/security.go
index 0d9628241f..2a0479ca58 100644
--- a/src/cmd/go/internal/work/security.go
+++ b/src/cmd/go/internal/work/security.go
@@ -177,10 +177,10 @@ var validLinkerFlags = []*lazyregexp.Regexp{
re(`-Wl,-Bdynamic`),
re(`-Wl,-berok`),
re(`-Wl,-Bstatic`),
- re(`-WL,-O([^@,\-][^,]*)?`),
+ re(`-Wl,-O[0-9]+`),
re(`-Wl,-d[ny]`),
re(`-Wl,--disable-new-dtags`),
- re(`-Wl,-e[=,][a-zA-Z0-9]*`),
+ re(`-Wl,-e[=,][a-zA-Z0-9]+`),
re(`-Wl,--enable-new-dtags`),
re(`-Wl,--end-group`),
re(`-Wl,--(no-)?export-dynamic`),
@@ -189,7 +189,7 @@ var validLinkerFlags = []*lazyregexp.Regexp{
re(`-Wl,--hash-style=(sysv|gnu|both)`),
re(`-Wl,-headerpad_max_install_names`),
re(`-Wl,--no-undefined`),
- re(`-Wl,-R([^@\-][^,@]*$)`),
+ re(`-Wl,-R,?([^@\-,][^,@]*$)`),
re(`-Wl,--just-symbols[=,]([^,@\-][^,@]+)`),
re(`-Wl,-rpath(-link)?[=,]([^,@\-][^,]+)`),
re(`-Wl,-s`),
diff --git a/src/cmd/go/internal/work/security_test.go b/src/cmd/go/internal/work/security_test.go
index aec9789185..591287c875 100644
--- a/src/cmd/go/internal/work/security_test.go
+++ b/src/cmd/go/internal/work/security_test.go
@@ -222,6 +222,11 @@ var badLinkerFlags = [][]string{
{"-Wl,-R,@foo"},
{"-Wl,--just-symbols,@foo"},
{"../x.o"},
+ {"-Wl,-R,"},
+ {"-Wl,-O"},
+ {"-Wl,-e="},
+ {"-Wl,-e,"},
+ {"-Wl,-R,-flag"},
}
func TestCheckLinkerFlags(t *testing.T) {
--
2.33.0

119
0101-Backport-cmd-go-cmd-cgo-in-_cgo_flags-use-one-line-p.patch Normal file
View File

@ -0,0 +1,119 @@
From 1c552fe2fd6152be3e1fc5f26635286fbd45a5c7 Mon Sep 17 00:00:00 2001
From: Ian Lance Taylor <iant@golang.org>
Date: Thu, 4 May 2023 14:06:39 -0700
Subject: [PATCH 3/3] [Backport] cmd/go,cmd/cgo: in _cgo_flags use one line per
flag
Offering: Cloud Core Network
CVE: CVE-2023-29405
Reference: https://go-review.googlesource.com/c/go/+/501216
The flags that we recorded in _cgo_flags did not use any quoting,
so a flag containing embedded spaces was mishandled.
Change the _cgo_flags format to put each flag on a separate line.
That is a simple format that does not require any quoting.
As far as I can tell only cmd/go uses _cgo_flags, and it is only
used for gccgo. If this patch doesn't cause any trouble, then
in the next release we can change to only using _cgo_flags for gccgo.
Thanks to Juho Nurminen of Mattermost for reporting this issue.
Note: Merged with CL: https://go-review.googlesource.com/c/go/+/501297
Edited-by: tangxi t00586138
Updates #60306
Fixes #60513
Fixes CVE-2023-29405
Change-Id: Id738a737ecae47babb34c4b4fc4d65336cf0c0f3
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1875094
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Roland Shoemaker <bracewell@google.com>
(cherry picked from commit bcdfcadd5612212089d958bc352a6f6c90742dcc)
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1902227
Run-TryBot: Roland Shoemaker <bracewell@google.com>
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1904341
Reviewed-by: Michael Knyszek <mknyszek@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/501216
Auto-Submit: Michael Knyszek <mknyszek@google.com>
Run-TryBot: David Chase <drchase@google.com>
TryBot-Bypass: David Chase <drchase@google.com>
Signed-off-by: Tang Xi tangxi6@huawei.com
---
src/cmd/cgo/out.go | 4 +++-
src/cmd/go/internal/work/gccgo.go | 14 ++++++-------
.../go/testdata/script/gccgo_link_ldflags.txt | 20 +++++++++++++++++++
3 files changed, 29 insertions(+), 9 deletions(-)
create mode 100644 src/cmd/go/testdata/script/gccgo_link_ldflags.txt
diff --git a/src/cmd/cgo/out.go b/src/cmd/cgo/out.go
index be4f6ad2d5..21607411c8 100644
--- a/src/cmd/cgo/out.go
+++ b/src/cmd/cgo/out.go
@@ -47,7 +47,9 @@ func (p *Package) writeDefs() {
fflg := creat(*objDir + "_cgo_flags")
for k, v := range p.CgoFlags {
- fmt.Fprintf(fflg, "_CGO_%s=%s\n", k, strings.Join(v, " "))
+ for _, arg := range v {
+ fmt.Fprintf(fflg, "_CGO_%s=%s\n", k, arg)
+ }
if k == "LDFLAGS" && !*gccgo {
for _, arg := range v {
fmt.Fprintf(fgo2, "//go:cgo_ldflag %q\n", arg)
diff --git a/src/cmd/go/internal/work/gccgo.go b/src/cmd/go/internal/work/gccgo.go
index 2f5d5d6283..75a0b7d815 100644
--- a/src/cmd/go/internal/work/gccgo.go
+++ b/src/cmd/go/internal/work/gccgo.go
@@ -251,14 +251,12 @@ func (tools gccgoToolchain) link(b *Builder, root *Action, out, importcfg string
const ldflagsPrefix = "_CGO_LDFLAGS="
for _, line := range strings.Split(string(flags), "\n") {
if strings.HasPrefix(line, ldflagsPrefix) {
- newFlags := strings.Fields(line[len(ldflagsPrefix):])
- for _, flag := range newFlags {
- // Every _cgo_flags file has -g and -O2 in _CGO_LDFLAGS
- // but they don't mean anything to the linker so filter
- // them out.
- if flag != "-g" && !strings.HasPrefix(flag, "-O") {
- cgoldflags = append(cgoldflags, flag)
- }
+ flag := line[len(ldflagsPrefix):]
+ // Every _cgo_flags file has -g and -O2 in _CGO_LDFLAGS
+ // but they don't mean anything to the linker so filter
+ // them out.
+ if flag != "-g" && !strings.HasPrefix(flag, "-O") {
+ cgoldflags = append(cgoldflags, flag)
}
}
}
diff --git a/src/cmd/go/testdata/script/gccgo_link_ldflags.txt b/src/cmd/go/testdata/script/gccgo_link_ldflags.txt
new file mode 100644
index 0000000000..4e91ae5650
--- /dev/null
+++ b/src/cmd/go/testdata/script/gccgo_link_ldflags.txt
@@ -0,0 +1,20 @@
+# Test that #cgo LDFLAGS are properly quoted.
+# The #cgo LDFLAGS below should pass a string with spaces to -L,
+# as though searching a directory with a space in its name.
+# It should not pass --nosuchoption to the external linker.
+
+[!cgo] skip
+
+go build
+
+[!exec:gccgo] skip
+
+go build -compiler gccgo
+
+-- go.mod --
+module m
+-- cgo.go --
+package main
+// #cgo LDFLAGS: -L "./ -Wl,--nosuchoption"
+import "C"
+func main() {}
--
2.33.0

1586
0102-Backport-runtime-implement-SUID-SGID-protections.patch Normal file
View File

File diff suppressed because it is too large Load Diff

14
golang.spec
View File

@ -58,7 +58,7 @@
Name: golang
Version: 1.15.7
Release: 27
Release: 28
Summary: The Go Programming Language
License: BSD and Public Domain
URL: https://golang.org/
@ -240,6 +240,10 @@ Patch6095: 0095-runtime-encapsulate-access-to-allgs.patch
Patch6096: 0096-Backport-html-template-emit-filterFailsafe-for-empty.patch
Patch6097: 0097-Backport-html-template-handle-all-JS-whitespace-char.patch
Patch6098: 0098-Backport-html-template-disallow-angle-brackets-in-CS.patch
Patch6099: 0099-Backport-cmd-go-disallow-package-directories-contain.patch
Patch6100: 0100-Backport-cmd-go-enforce-flags-with-non-optional-argu.patch
Patch6101: 0101-Backport-cmd-go-cmd-cgo-in-_cgo_flags-use-one-line-p.patch
#Patch6102: 0102-Backport-runtime-implement-SUID-SGID-protections.patch
Patch9001: 0001-drop-hard-code-cert.patch
Patch9002: 0002-fix-patch-cmd-go-internal-modfetch-do-not-sho.patch
@ -479,6 +483,12 @@ fi
%files devel -f go-tests.list -f go-misc.list -f go-src.list
%changelog
* Wed Jun 28 2023 hanchao <hanchao63@huawei.com> - 1.15.7-28
- Type:CVE
- CVE:CVE-2023-29402,CVE-2023-29404,CVE-2023-29405,CVE-2023-29403
- SUG:NA
- DESC: fix CVE-2023-29402,CVE-2023-29404,CVE-2023-29405,CVE-2023-29403
* Mon May 22 2023 hanchao <hanchao63@huawei.com> - 1.15.7-27
- Type:CVE
- CVE:CVE-2023-29400,CVE-2023-24539,CVE-2023-24540
@ -527,7 +537,7 @@ fi
- SUG:NA
- DESC:fix bad %goroot}/lib/ macro
* Thu Spe 15 2022 hanchao<hanchao47@huawei.com> - 1.15.7-19
* Thu Sep 15 2022 hanchao<hanchao47@huawei.com> - 1.15.7-19
- Type:CVE
- CVE:CVE-2022-27664
- SUG:NA