Bug 2571442 (CVE-2026-97034)
| Summary: | CVE-2026-97034 cmd/go: golang: cmd/go: arbitrary command execution via untrusted GCC spec files | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | akhatavk, aos-team-art-private, asdas, cahl, crizzo, dfreiber, dpaolell, drow, dymurray, jburrell, jdelft, jupierce, kaycoth, lgarciaa, ljawale, mbiarnes, msilmser, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sdawley, sghai, sidsharm, suppawar, vkumar, vlaad, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in cmd/go. This flaw allows an attacker to achieve arbitrary command execution when a developer or automated system builds an untrusted Go package that uses cgo (Go's C language integration). When compiling with the GCC (GNU Compiler Collection) compiler, specific build flags cause the linker to search for and evaluate configuration spec files from untrusted directories. An attacker can supply a specially crafted package containing a malicious spec file, resulting in command execution on the host machine during the build process.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)" or "%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot directories (including subdirectories and multilib sibling directories such as "../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined with "-static" or "-static-lib*". The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.