Bug 1897643 (CVE-2020-28366)
| Summary: | CVE-2020-28366 golang: malicious symbol names can lead to code execution at build time | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | admiller, amctagga, amurdaca, aos-bugs, aos-storage-staff, asm, bbreard, bbrownin, bmontgom, bodavis, chazlett, cnv-qe-bugs, deparker, emachado, eparis, erooth, fdeutsch, fweimer, gbrown, hchiramm, himadhav, hvyas, imcleod, jakub, jburrell, jcajka, jmulligan, jokerman, jpadman, jshaughn, jwendell, jwon, kconner, krathod, law, lemenkov, madam, markito, mcooper, miabbott, mnewsome, mpolacek, nstielau, ohudlick, puebele, rcernich, renich, rhs-bugs, rrajasek, rtalur, sipoyare, sponnaga, stirabos, storage-qa-internal, tjelinek, tstellar, twalsh, vbatts |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| See Also: |
https://issues.redhat.com/browse/SRVCOM-1153 https://issues.redhat.com/browse/SRVCOM-1154 https://issues.redhat.com/browse/SRVCOM-1155 |
||
| Whiteboard: | |||
| Fixed In Version: | go 1.15.5, go 1.14.12 | Doc Type: | If docs needed, set a value |
| Doc Text: |
An input validation vulnerability was found in Go. From a generated go file (from the cgo tool), it is possible to modify symbols within that object file and specify code. This flaw allows an attacker to create a repository that includes malicious pre-built object files that could execute arbitrary code when downloaded and run via `go get` or `go build` while building a Go project. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-12-15 22:19:20 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1897644, 1897645, 1898648, 1898649, 1898821, 1898832, 1898837, 1898956, 1899184, 1905306, 1906663 | ||
| Bug Blocks: | 1897653 | ||
|
Description
Guilherme de Almeida Suckevicz
2020-11-13 17:09:20 UTC
Created golang tracking bugs for this issue: Affects: epel-all [bug 1897645] Affects: fedora-all [bug 1897644] External References: https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM/m/fLguyiM2CAAJ Mitigation:
If it's possible to confirm that the go project being built does not rely on any cgo code in the included dependencies, the env variable CGO_ENABLED=0 can be specified when using either `go get` or `go build`.
For example:
CGO_ENABLED=0 go get github.com/someproject
This will not stop the files being downloaded, but will stop any automatic complication of the cgo code, including inlined in the go file and separate .c files. Of course this will only be effective if cgo is not relied upon in a given dependency and may not be appropriate in all scenarios.
This issue has been addressed in the following products: Red Hat Developer Tools Via RHSA-2020:5333 https://access.redhat.com/errata/RHSA-2020:5333 Statement: While OpenShift Container Platform (OCP), Red Hat OpenShift Jaeger (RHOSJ), OpenShift Service Mesh (OSSM) and OpenShift Virtualization all contain RPMs and containers which are compiled with a vulnerable version of Go, the vulnerability is specific to the building of Go code itself. Such as using `go get` or `go build` and as such the relevant components have been marked as not affected. Additionally, only the main RPMs and containers for OCP, RHOSJ, OSSM and OpenShift Virtualization are represented due to the large volume of not affected components. Red Hat Ceph Storage 3 ships the vulnerable version of go, and an attacker building go code on RHCS 3 could potentially exploit this vulnerability. This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:5493 https://access.redhat.com/errata/RHSA-2020:5493 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-28366 This issue has been addressed in the following products: Openshift Serverless 1 on RHEL 8 Via RHSA-2021:0145 https://access.redhat.com/errata/RHSA-2021:0145 This issue has been addressed in the following products: Openshift Serveless 1.12 Via RHSA-2021:0146 https://access.redhat.com/errata/RHSA-2021:0146 |