Skip to content

x/vulndb: potential Go vuln in runtime: CVE-2023-29403 #1840

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
tatianab opened this issue Jun 7, 2023 · 2 comments
Closed

x/vulndb: potential Go vuln in runtime: CVE-2023-29403 #1840

tatianab opened this issue Jun 7, 2023 · 2 comments
Assignees
@tatianab
Labels
stdlib

Comments

@tatianab
Copy link
Contributor

tatianab commented Jun 7, 2023

CVE ID

No response

GHSA ID

No response

Additional information

runtime: unexpected behavior of setuid/setgid binaries

The Go runtime didn't act any differently when a binary had the setuid/setgid
bit set. On Unix platforms, if a setuid/setgid binary was executed with standard
I/O file descriptors closed, opening any files could result in unexpected
content being read/written with elevated prilieges. Similarly if a setuid/setgid
program was terminated, either via panic or signal, it could leak the contents
of its registers.

Thanks to Vincent Dehors from Synacktiv for reporting this issue.

This is CVE-2023-29403 and Go issue https://go.dev/issue/60272.

https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
@tatianab tatianab added the stdlib label Jun 7, 2023
@tatianab tatianab self-assigned this Jun 7, 2023
@tatianab tatianab changed the title x/vulndb: potential Go vuln in runtime: x/vulndb: potential Go vuln in runtime: CVE-2023-29403 Jun 7, 2023
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/501837 mentions this issue: data/reports: add GO-2023-1840.yaml

gopherbot pushed a commit that referenced this issue Jun 8, 2023
@tatianab
data/reports: add GO-2023-1840.yaml
93c684c 
Aliases: CVE-2023-29403

Updates #1840

Change-Id: I0c0829d98d1ec4ff5997245189958b4b7cc362d8
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/501837
Reviewed-by: Roland Shoemaker <[email protected]>
Run-TryBot: Tatiana Bradley <[email protected]>
TryBot-Result: Gopher Robot <[email protected]>
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/501536 mentions this issue: data/reports: update GO-2023-1840.yaml

gopherbot pushed a commit that referenced this issue Jun 8, 2023
@tatianab
data/reports: update GO-2023-1840.yaml
a674883 
Updates #1840

Change-Id: I26cf944bbf0f8f29dd2d413c3811e29088c40f43
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/501536
Reviewed-by: Damien Neil <[email protected]>
Run-TryBot: Tatiana Bradley <[email protected]>
TryBot-Result: Gopher Robot <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tatianab tatianab

Labels
stdlib
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@tatianab @gopherbot