Go 1.20.5 のリリース【セキュリティ・アップデート】

The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo.

This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via “go get”, are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).

The Go runtime didn’t act any differently when a binary had the setuid/setgid bit set. On Unix platforms, if a setuid/setgid binary was executed with standard I/O file descriptors closed, opening any files could result in unexpected content being read/written with elevated prilieges. Similarly if a setuid/setgid program was terminated, either via panic or signal, it could leak the contents of its registers.

The go command may execute arbitrary code at build time when using cgo. This may occur when running “go get” on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a “#cgo LDFLAGS” directive.

Due to an unfortunate mistake, this change will break the use of “#cgo LDFLAGS” directives when using -compiler=gccgo. Most people using gccgo or GoLLVM use the cmd/go that is distributed with those tools, and that is unaffected. Therefore, we will fix this in the next minor release. The current minor releases 1.20.5 and 1.19.10 are unfortunately broken for some cases when using gccgo or GoLLVM. Our apologies for the mishap. Thanks to Jeffrey Tolar for spotting the problem.