Nicholashusin

Building a malicious package containing `.syso` files or cgo linker inputs can lead to the injection of arbitrary linker flags or the execution of arbitrary code during link time. This occurs because linker input files—such as `.syso` files, direct object or library inputs in `#cgo LDFLAGS`, and libraries in `-L` directories—are passed to the external linker without format validation or checks for embedded linker options. This flaw allows the execution of GNU ld implicit linker scripts disguised as libraries or `.syso` files, the injection of unallowlisted linker flags via PE/COFF `.drectve` sections on Windows or Mach-O `LC LINKER OPTION` load commands on Darwin, and the invocation of LTO (Link Time Optimization) plugins via GCC or LLVM LTO intermediate representation sections in ELF, PE/COFF, or Mach-O objects.

Building a malicious package using cgo with GCC can lead to arbitrary command execution during link time through the use of untrusted GCC spec files (`specs` or `*.spec`). This occurs when linking with `-fopenmp`, `-fopenacc`, or `-fsanitize=` within `#cgo LDFLAGS`. In these cases, GCC's built-in link spec evaluates `%:include(libgomp.spec)` or `%:include(libsanitizer.spec)` and searches for spec files in the working directory, `-L` directories, and sysroot directories, including subdirectories and multilib sibling directories like `../lib64`.

Building a malicious package using cgo can lead to arbitrary code execution during link time. This occurs when linker script files are passed to the host linker through the `#cgo LDFLAGS` directive. Specifically, certain split `-Wl,` flags that require a subsequent argument, such as `-Wl,-rpath`, `-Wl,--just-symbols`, and `-Wl,-undefined`, previously allowed a second argument without the `-Wl,` prefix. The compiler driver would then pass this argument directly to the linker as a positional input file. Furthermore, when utilizing GNU ld.bfd, flags including `-framework`, `-Wl,-framework`, `-Wl,-undefined`, `-Wl,--just-symbols`, `-Wl,-R`, `-Wl,-subsystem`, and `-Wl,-sectcreate` (on non-Darwin platforms) could cause ld.bfd to treat their arguments as linker scripts if they corresponded to a regular file on disk.

Building a malicious package using cgo can lead to arbitrary code execution during the build process via specific compiler and linker flags in `#cgo` directives. The issue involves several mechanisms: the `--sysroot` flag in GCC and Clang allows relocating compiler subprograms and CRT startup objects to an attacker-controlled directory; the `-target` flag in Clang may execute helper tools from the current working directory if not found in the PATH; the `-isysroot` and `-Wl,-syslibroot` flags can pass a regular file to GNU ld.bfd, which is then interpreted as a positional linker script; and the `-x` flag allows the specification of arbitrary compiler input languages not supported by cgo.

Building a malicious package using `#cgo pkg-config:` directives can lead to the loading of untrusted pkg-config `.pc` files or the injection of unvalidated compiler and linker flags. This occurs because the pkg-config flag allowlist previously permitted `--with-path=` and `--personality=`, and allowed `--define-variable=` values starting with `=` or `$`, which could rewrite system `.pc` file paths into sysroot-prefixed linker search paths. Additionally, package arguments ending in `.pc` or containing path separators or `..` allowed pkg-config to load local `.pc` files directly from the package directory. Furthermore, flags returned by `pkg-config --cflags` in `cgoCPPFLAGS` were not verified when determining the safety of internal linking.

Functions within the `net/textproto` package include input as part of the error when returning errors. This behavior allows an attacker to inject misleading content into errors that are subsequently printed or logged.

By default, the software communicates via pipe, but the `-port` and `-listen` flags are available for debugging. If the `-listen` flag is provided without an explicit host (e.g., ':8080') or if the `-port` flag is used, the application binds to 0.0.0.0. This configuration may allow a malicious actor on the same network to achieve arbitrary code execution.