os: Root permits access to parent directory (fix CVE-2025-22873) #73555
Labels
NeedsFix
The path to resolution is known, but the work has not been done.
release-blocker
Security
vulncheck or vulndb
Issues for the x/vuln or x/vulndb repo
Milestone
Comments
|
@gopherbot please backport to go1.24 |
|
Backport issue(s) opened: #73556 (for 1.24). Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases. |
|
Please check if this needs a backport also to 1.23, to be released in 1.23.9 (milestone), as expected from the announcement. |
|
Change https://go.dev/cl/670357 mentions this issue: |
gopherbot
pushed a commit
that referenced
this issue
May 6, 2025
…n ../ The doInRoot function operates on a path split into components. The final path component retained any trailing path separator characters, to permit operations in a Root to retain the trailing-separator behavior of non-Root operations. However, doInRoot failed to take trailing separators into account when checking for .. path components. This could permit opening the parent directory of the Root with a path ending in "../". Change the split path to never include path separators in components, and handle trailing separators independently of the split path. Thanks to Dan Sebastian Thrane of SDU eScience Center for reporting this issue. Fixes #73556 Updates #73555 Fixes CVE-2025-22873 Change-Id: I9a33a145c22f5eb1dd4e4cafae5fcc61a8d4f0d4 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2160 Reviewed-by: Neal Patel <[email protected]> Reviewed-by: Roland Shoemaker <[email protected]> Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2180 Commit-Queue: Damien Neil <[email protected]> Reviewed-by: Damien Neil <[email protected]> Reviewed-on: https://go-review.googlesource.com/c/go/+/670357 Reviewed-by: Carlos Amedee <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]>
|
Change https://go.dev/cl/670036 mentions this issue: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
os: Root permits access to parent directory
It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.
Root now correctly returns an error in this case.
This is CVE-2025-22873 and Go issue https://go.dev/issue/73555.
Thanks to Dan Sebastian Thrane of SDU eScience Center for reporting this issue.
This is a PRIVATE issue for CVE-2025-22873, tracked in http://b/408209442.
/cc @golang/security and @golang/release
The text was updated successfully, but these errors were encountered: