mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-25 11:30:37 -09:00
Code Issues Packages Projects Releases Wiki Activity
Files
2025.02.x
buildroot/package/go/go.mk
Peter Korsgaard 989de112fd package/go: security bump to version 1.26.6 
Fixes the following security issues:

 - x/mod/sumdb/tlog: fix transparency log tile verification bypass

   A malicious GOPROXY was previously capable of forging up to two sumdb
   tiles that allow for a requested module to bypass the GOSUMDB check and
   persist attacker-controlled module content to a local Go module cache.

   This attack allows for a malicious GOPROXY to serve malicious module
   content that cannot be detected by evaluating the transparency log.

   All tiles are now correctly verified against their parents.

   In order to determine if you have been affected:

   rm -r go.sum go.work.sum vendor/ && go mod tidy

   Thanks to Filippo Valsorda (Geomys) for reporting this issue.

   This is CVE-2026-56865 and Go issue https://go.dev/issue/80744.

 - x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup

   A malicious GOSUMDB was capable of serving arbitrary module content not
   contained within the transparency log.

   This attack allows for a coordinating GOPROXY and GOSUMDB to serve a
   client malicious module content that cannot be detected by evaluating
   the transparency log.

   In order to determine if you have been affected:

   rm -r go.sum go.work.sum vendor/ && go mod tidy

   Thanks to mundur for reporting this issue.

   This is CVE-2026-56864 and Go issue https://go.dev/issue/80745.

 - encoding/xml: add recursion depth guard during decode

   Previously, DecodeElement would reset the depth counter causing it to
   never fire; this could lead to stack exhaustion.

   This is CVE-2026-56859 and Go issue https://go.dev/issue/80481.

 - net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check

   When a server is configured to support unencrypted HTTP/2, it reads a few
   bytes from each new connection to see if they contain the HTTP/2 client
   preface.  Previously, this was being done with no timeout applied.
   ReadHeaderTimeout is now applied for this.

   This is CVE-2026-56853 and Go issue https://go.dev/issue/80205.

 - net/url: avoid quadratic complexity in resolvePath

   Previously, resolving relative paths containing parent directory (..)
   segments performed string conversions and buffer rewrites on each step,
   resulting in quadratic time complexity and high memory allocation
   overhead.

   Now, path resolution operates on a byte buffer using index-based
   backtracking for ..  segments, eliminating the quadratic time complexity
   and significantly reducing memory allocations.

   This is CVE-2026-56860 and Go issue https://go.dev/issue/80494.

 - golang.org/x/net/dns/dnsmessage: panic when parsing invalid SVCB record

   Parsing an invalid SVCB or HTTPS RR can panic when the size of a
   parameter value overflows the message buffer.

   Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.

   This is CVE-2026-46600 and Go issue https://go.dev/issue/79795.

 - crypto/tls: limit handshake messages we are willing to accept post-handshake

   Previously, we always counted handshake messages, such as KeyUpdate, as
   state-advancing, regardless of whether a handshake has been completed or
   not.  As a result, a malicious client can keep sending KeyUpdate messages
   to force the server to keep performing key derivation operations
   indefinitely.

   Thanks to Qi Deng of Aurascape.ai for reporting this issue.

   This is CVE-2026-56862 and Go issue https://go.dev/issue/80528.

 - html/template: fix Javascript regexp context tracking

   Previously, pathological inputs could close an unescaped / early,
   allowing for attack-controlled data to inject arbitrary content,
   potentially leading to XSS.

   Thanks to Ali Sherif for reporting this issue.

   This is CVE-2026-56858 and Go issue https://go.dev/issue/80435.

 - x/net/idna: failure to reject ASCII-only Punycode-encoded labels

   The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded
   labels that decode to an ASCII-only label.  For example,
   ToUnicode("xn--example-.com") incorrectly returned the name "example.com"
   rather than an error.

   The idna package implements the processing algorithm from UTS 46.  Older
   versions of UTS 46 included a specification bug which permitted multiple
   ASCII labels to decode to the same Unicode label.  UTS 46 revision 33
   fixed the specification bug.  The idna package now implements the updated
   specification.

   This behavior can lead to privilege escalation in programs using the idna
   package.  For example, a program which performs privilege checks on the
   ASCII hostname may reject "example.com" but permit "xn--example-.com".
   If that program subsequently converts the ASCII hostname to Unicode, it
   will inadvertently permits access to the Unicode name "example.com".

   Thanks to KC1zs4 (https://github.com/KC1zs4) for reporting this issue.

   This is CVE-2026-39821 and Go issue https://go.dev/issue/78760.

 - encoding/asn1: enforce maximum recursion depth

   Enforce a recursion limit in Unmarshal to prevent stack exhaustion when
   parsing deeply-nested, recursive structures.

   Thanks to Marwan Atia (marwansamir688@gmail.com) for reporting this issue.

   This is CVE-2026-33818 and Go issue https://go.dev/issue/80405.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9e9110bf23)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2026-08-28 15:57:20 +02:00

148 lines
4.4 KiB
Makefile
Raw Permalink Blame History

################################################################################
#
# go
#
################################################################################
# When bumping this to 1.27 (or beyond), remove the workaround for
# upstream issue https://github.com/golang/go/issues/77436, below
# (i.e. revert the commit adding these lines).
GO_VERSION = 1.26.6
HOST_GO_GOPATH = $(HOST_DIR)/share/go-path
HOST_GO_HOST_CACHE = $(HOST_DIR)/share/host-go-cache
HOST_GO_ROOT = $(HOST_DIR)/lib/go
HOST_GO_TARGET_CACHE = $(HOST_DIR)/share/go-cache
# We pass an empty GOBIN, otherwise "go install: cannot install
# cross-compiled binaries when GOBIN is set"
HOST_GO_COMMON_ENV = \
GO111MODULE=on \
GOFLAGS=-mod=vendor \
GOROOT="$(HOST_GO_ROOT)" \
GOPATH="$(HOST_GO_GOPATH)" \
GOCACHE="$(HOST_GO_TARGET_CACHE)" \
GOMODCACHE="$(HOST_GO_GOPATH)/pkg/mod" \
GOPROXY=off \
GOTOOLCHAIN=local \
PATH=$(BR_PATH) \
GOBIN= \
CGO_ENABLED=$(HOST_GO_CGO_ENABLED)
ifeq ($(BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS),y)
ifeq ($(BR2_arm),y)
GO_GOARCH = arm
ifeq ($(BR2_ARM_CPU_ARMV5),y)
GO_GOARM = 5
else ifeq ($(BR2_ARM_CPU_ARMV6),y)
GO_GOARM = 6
else ifeq ($(BR2_ARM_CPU_ARMV7A),y)
GO_GOARM = 7
else ifeq ($(BR2_ARM_CPU_ARMV8A),y)
# Go doesn't support 32-bit GOARM=8 (https://github.com/golang/go/issues/29373)
# but can still benefit from armv7 optimisations
GO_GOARM = 7
endif
else ifeq ($(BR2_aarch64),y)
GO_GOARCH = arm64
else ifeq ($(BR2_i386),y)
GO_GOARCH = 386
# i386: use softfloat if no SSE2: https://golang.org/doc/go1.16#386
ifneq ($(BR2_X86_CPU_HAS_SSE2),y)
GO_GO386 = softfloat
endif
else ifeq ($(BR2_x86_64),y)
GO_GOARCH = amd64
else ifeq ($(BR2_powerpc64),y)
GO_GOARCH = ppc64
else ifeq ($(BR2_powerpc64le),y)
GO_GOARCH = ppc64le
else ifeq ($(BR2_mips64),y)
GO_GOARCH = mips64
else ifeq ($(BR2_mips64el),y)
GO_GOARCH = mips64le
else ifeq ($(BR2_riscv),y)
GO_GOARCH = riscv64
else ifeq ($(BR2_s390x),y)
GO_GOARCH = s390x
endif
# For the convenience of target packages.
HOST_GO_TOOLDIR = $(HOST_GO_ROOT)/pkg/tool/linux_$(GO_GOARCH)
HOST_GO_TARGET_ENV = \
$(HOST_GO_COMMON_ENV) \
GOOS="linux" \
GOARCH=$(GO_GOARCH) \
$(if $(GO_GO386),GO386=$(GO_GO386)) \
$(if $(GO_GOARM),GOARM=$(GO_GOARM)) \
CC="$(TARGET_CC)" \
CXX="$(TARGET_CXX)" \
CGO_LDFLAGS="$(TARGET_LDFLAGS)" \
GOTOOLDIR="$(HOST_GO_TOOLDIR)"
# Workaround for https://github.com/golang/go/issues/77436
HOST_GO_TARGET_ENV += \
CGO_CFLAGS="$(subst -g3,-g2,$(TARGET_CFLAGS))" \
CGO_CXXFLAGS="$(subst -g3,-g2,$(TARGET_CXXFLAGS))"
# Allow packages to use cgo support if it is available for the target. They
# will need the toolchain for cgo support; for convenence, include that
# dependency here.
#
# Note that any target package needing cgo support must include 'depends on
# BR2_PACKAGE_HOST_GO_TARGET_CGO_LINKING_SUPPORTS' in its config file.
ifeq ($(BR2_PACKAGE_HOST_GO_TARGET_CGO_LINKING_SUPPORTS),y)
HOST_GO_DEPENDENCIES_CGO += toolchain
HOST_GO_CGO_ENABLED = 1
else
HOST_GO_CGO_ENABLED = 0
endif
else # !BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS
ifeq ($(BR2_PACKAGE_HOST_GO_HOST_CGO_LINKING_SUPPORTS),y)
HOST_GO_CGO_ENABLED = 1
else # !BR2_PACKAGE_HOST_GO_HOST_CGO_LINKING_SUPPORTS
HOST_GO_CGO_ENABLED = 0
endif # BR2_PACKAGE_HOST_GO_HOST_CGO_LINKING_SUPPORTS
endif # BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS
# Ensure the toolchain is available, whatever the provider
HOST_GO_DEPENDENCIES += $(HOST_GO_DEPENDENCIES_CGO)
# For the convenience of host golang packages
HOST_GO_HOST_ENV = \
$(HOST_GO_COMMON_ENV) \
GOOS="" \
GOARCH="" \
GOCACHE="$(HOST_GO_HOST_CACHE)" \
CC="$(HOSTCC_NOCCACHE)" \
CXX="$(HOSTCXX_NOCCACHE)" \
CGO_CFLAGS="$(HOST_CFLAGS)" \
CGO_CXXFLAGS="$(HOST_CXXFLAGS)" \
CGO_LDFLAGS="$(HOST_LDFLAGS)"
define GO_BINARIES_INSTALL
$(INSTALL) -D -m 0755 $(@D)/bin/go $(HOST_GO_ROOT)/bin/go
$(INSTALL) -D -m 0755 $(@D)/bin/gofmt $(HOST_GO_ROOT)/bin/gofmt
mkdir -p $(HOST_DIR)/bin
ln -sf ../lib/go/bin/go $(HOST_DIR)/bin/
ln -sf ../lib/go/bin/gofmt $(HOST_DIR)/bin/
cp -a $(@D)/lib $(HOST_GO_ROOT)/
mkdir -p $(HOST_GO_ROOT)/pkg
cp -a $(@D)/pkg/include $(HOST_GO_ROOT)/pkg/
cp -a $(@D)/pkg/tool $(HOST_GO_ROOT)/pkg/
# The Go sources must be installed to the host/ tree for the Go stdlib.
cp -a $(@D)/src $(HOST_GO_ROOT)/
# Set file timestamps to prevent the Go compiler from rebuilding the stdlib
# when compiling other programs.
find $(HOST_GO_ROOT) -type f -exec touch -r $(@D)/bin/go {} \;
endef
$(eval $(host-virtual-package))
include $(sort $(wildcard package/go/*/*.mk))
Reference in New Issue View Git Blame Copy Permalink