[<prev] [<thread-prev] [day] [month] [year] [list]
Message-ID: <aWw9pvIvulohwgSg@mertle>
Date: Sat, 17 Jan 2026 20:55:50 -0500
From: Michael Orlitzky <michael@...itzky.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2025-8110 in Gogs self-hosted git service
On 2026-01-17 15:02:42, Collin Funk wrote:
>
> This just introduces TOCTOU races, no?
>
> If someone can delete a portion of "opts.NewTreeName" and recreate an
> element as a symbolic link before "os.MkdirAll" is executed, they would
> be able to achieve the same thing as before the patch.
>
> Surely Go has a way to use O_NOFOLLOW, right? That would be the correct
> way to do it.
I have not looked at the actual issue here, but in general even
O_NOFOLLOW is insufficient, because it only affects the trailing path
component. To avoid symlinks in other components, you must carefully
openat() each path component, one at a time, starting from the root.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
