1 line
1.9 KiB
JSON
1 line
1.9 KiB
JSON
{"schema_version":"1.9.2","id":"GO-2026-6854","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.799312883Z","aliases":["CVE-2026-97037"],"summary":"Linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/go","details":"Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via \"#cgo LDFLAGS\".\n\nSplit \"-Wl,\" flags that consume a following argument (such as \"-Wl,-rpath\", \"-Wl,--just-symbols\", and \"-Wl,-undefined\") previously accepted a bare second argument without a \"-Wl,\" prefix, which the compiler driver passes directly to the linker as a positional input file. Additionally, when using GNU ld.bfd, flags such as \"-framework\", \"-Wl,-framework\", \"-Wl,-undefined\", \"-Wl,--just-symbols\", \"-Wl,-R\", \"-Wl,-subsystem\", and (on non-Darwin platforms) \"-Wl,-sectcreate\" could cause ld.bfd to interpret their arguments as linker scripts if they named a regular file on disk.\n\nThe go command now requires a \"-Wl,\" prefix on the second token of split \"-Wl,\" flags (except \"-Wl,-R\"), verifies that these flags do not reference linker script files, and disallows bare \"-Wl,--warn-backrefs-exclude\".","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/go"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6854.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862150"},{"type":"REPORT","url":"https://go.dev/issue/82573"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6854"}} |