Headline

RHSA-2023:3922: Red Hat Security Advisory: go-toolset:rhel8 security update

An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2023-29402: The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).
CVE-2023-29403: On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.
CVE-2023-29404: The go command may execute arbitrary code at build time when using cgo. This may occur when running “go get” on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a “#cgo LDFLAGS” directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers.
CVE-2023-29405: The go command may execute arbitrary code at build time when using cgo. This may occur when running “go get” on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a “#cgo LDFLAGS” directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #c++#ibm #sap

Synopsis

Critical: go-toolset:rhel8 security update

Type/Severity

Security Advisory: Critical

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

golang: cmd/go: go command may generate unexpected code at build time when using cgo (CVE-2023-29402)
golang: cmd/go: go command may execute arbitrary code at build time when using cgo (CVE-2023-29404)
golang: cmd/cgo: Arbitratry code execution triggered by linker flags (CVE-2023-29405)
golang: runtime: unexpected behavior of setuid/setgid binaries (CVE-2023-29403)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Products

Red Hat Enterprise Linux for x86_64 8 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
Red Hat Enterprise Linux for IBM z Systems 8 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
Red Hat Enterprise Linux for Power, little endian 8 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
Red Hat Enterprise Linux Server - TUS 8.8 x86_64
Red Hat Enterprise Linux for ARM 64 8 aarch64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64

Fixes

BZ - 2216965 - CVE-2023-29403 golang: runtime: unexpected behavior of setuid/setgid binaries
BZ - 2217562 - CVE-2023-29402 golang: cmd/go: go command may generate unexpected code at build time when using cgo
BZ - 2217565 - CVE-2023-29404 golang: cmd/go: go command may execute arbitrary code at build time when using cgo
BZ - 2217569 - CVE-2023-29405 golang: cmd/cgo: Arbitratry code execution triggered by linker flags

CVEs

CVE-2023-29402
CVE-2023-29403
CVE-2023-29404
CVE-2023-29405

Red Hat Enterprise Linux for x86_64 8

SRPM

delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src.rpm

SHA-256: 1b037c6c0f16e789c9cf361b6cf87e5e06661e7f29deae013bb1ede7f3c1ff93

go-toolset-1.19.10-1.module+el8.8.0+19203+782922b7.src.rpm

SHA-256: b080c2a139afc0d41e6053dcc1f00612fab1c2d987036e673dac7c02b6cbbccb

golang-1.19.10-1.module+el8.8.0+19203+782922b7.src.rpm

SHA-256: ccbb24fc572c0635af214c404496b8bf127def93b57ba8d1748cdd24898faf12

x86_64

golang-docs-1.19.10-1.module+el8.8.0+19203+782922b7.noarch.rpm

SHA-256: 428cb535d55784be0b55bf00ba37be20b69a375d1f587cf18ced0a5f8025254f

golang-misc-1.19.10-1.module+el8.8.0+19203+782922b7.noarch.rpm

SHA-256: c39f5c8125f7a40b72d39f07f9103820c2273fbd9e3221e24c849f0794b10efe

golang-src-1.19.10-1.module+el8.8.0+19203+782922b7.noarch.rpm

SHA-256: 57690fa0bda83068f8d2923a306fbcde81fe1116ef0689d0e09998039e26fd47

golang-tests-1.19.10-1.module+el8.8.0+19203+782922b7.noarch.rpm

SHA-256: 6a6eea4e3b4f534a407ef9246a2af77c3fcb59fe7261628e166c88a1e8a66f4e

delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64.rpm

SHA-256: e63fbb1595650d32386fe757c131a9475710f50f3df6c673b9ee3d7da17fb40b

delve-debuginfo-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64.rpm

SHA-256: 10cbdf420e26f44c6a556c9bac32f8d4d9f55f2c1294009710248550c0ed1528

delve-debugsource-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64.rpm

SHA-256: b9ec866e5579c7683dfc4a6efd2fb41b21e3635de5fac94c4f9870f647f9c869

go-toolset-1.19.10-1.module+el8.8.0+19203+782922b7.x86_64.rpm

SHA-256: f862a710c91e908e9503fc639bad9226bf4eb8a67c0061ac7eb3d0429038b3ad

golang-1.19.10-1.module+el8.8.0+19203+782922b7.x86_64.rpm

SHA-256: 3d9f23dd9e8ed82a62e33e54a1ee194c77174d402b5b48396f5c6dd6c54f9a8f

golang-bin-1.19.10-1.module+el8.8.0+19203+782922b7.x86_64.rpm

SHA-256: c69660c1669da27c58fc9380d1dc738ade7ef0ae2c03048a66ef427d1c289dd6

golang-race-1.19.10-1.module+el8.8.0+19203+782922b7.x86_64.rpm

SHA-256: d64c74c8d67ad39f6baad88a01206b8ecee753b7ed6d04f4683697090f9dd080

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8