Unsafe behavior in setuid/setgid binaries in runtime

CVE-2023-29403

What is CVE-2023-29403?

On Unix platforms, the Go runtime does not properly differentiate the execution of binaries with setuid/setgid permissions. This oversight can lead to serious security implications, particularly when a setuid/setgid binary is run while the standard I/O file descriptors are closed. In such cases, any files accessed may inadvertently have their contents altered or exposed due to elevated privileges. Additionally, if a setuid/setgid program crashes or is interrupted, there is a risk that sensitive data contained in its registers may be leaked. This vulnerability underscores the importance of cautious management of permissions in system-level programming.

References