[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID:
<DS1PR04MB96556A85F05BCD1105205EC0C092A@DS1PR04MB9655.namprd04.prod.outlook.com>
Date: Sat, 17 May 2025 06:21:41 +0000
From: "Caveney, Seamus G" <sgcaveney@...ttleschools.org>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
Carlos O'Donell <carlos@...hat.com>
Subject: RE: The GNU C Library security advisories update for
2025-05-16
> From: Solar Designer <solar@...nwall.com>
> Sent: Friday, May 16, 2025 10:59 PM
> To: Carlos O'Donell <carlos@...hat.com>
> Cc: oss-security@...ts.openwall.com
> Subject: Re: [oss-security] The GNU C Library security advisories update for 2025-05-16
>
> [...]
>
> Notably, Go produces static binaries, and I guess would include glibc from its own build? Do they also use any of the affected functions?
> Searching around shows people building Go programs complain about the glibc "warning: Using 'getaddrinfo' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking" (and ditto for some other functions), but only a subset (maybe
> none?) of those programs would be installed SUID/SGID/setcaps. Are we aware of any?
>
> Alexander
>
Go has poor support for SUID/SGID out of the box, due to interactions between the semantics of goroutines and Linux setugid syscalls applying on a per-thread basis. AIUI it's explicitly advised to not drop/gain privileges within a Golang binary itself. I would imagine capabilities have similar drawbacks since they are also per-thread attributes.
OTOH, much of the Golang software I've seen that does need privileges tends to be run as root directly, making this attack a bit of a moot point.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
