GO-2023-1840
See a problem?- Source
- https://pkg.go.dev/vuln/GO-2023-1840
- Import Source
- https://vuln.go.dev/ID/GO-2023-1840.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2023-1840
- Aliases
- Published
- 2023-06-08T20:16:06Z
- Modified
- 2024-05-20T16:03:47Z
- Summary
- Unsafe behavior in setuid/setgid binaries in runtime
- Details
-
On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors.
If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.
- References
- Credits
-
-
- Vincent Dehors from Synacktiv
-
Affected packages
Go / stdlib
Package
- Name
- stdlib
- View open source insights on deps.dev
- Purl
- pkg:golang/stdlib