AZL-113411: CVE-2026-97037 affecting package gcc 13.2.0-7
Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS". Split "-Wl," flags that consume a following argument (such as "-Wl,-rpath", "-Wl,--just-symbols", and "-Wl,-undefined") previously accepted a bare second argument without a "-Wl," prefix, which the compiler driver passes directly to the linker as a positional input file. Additionally, when using GNU ld.bfd, flags such as "-framework", "-Wl,-framework", "-Wl,-undefined", "-Wl,--just-symbols", "-Wl,-R", "-Wl,-subsystem", and (on non-Darwin platforms) "-Wl,-sectcreate" could cause ld.bfd to interpret their arguments as linker scripts if they named a regular file on disk. The go command now requires a "-Wl," prefix on the second token of split "-Wl," flags (except "-Wl,-R"), verifies that these flags do not reference linker script files, and disallows bare "-Wl,--warn-backrefs-exclude".
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In Go cgo linker flags, prefix the second token of split -Wl, flags with -Wl, (except for -Wl,-R); do not pass linker-script files through these flags, and do not use bare -Wl,--warn-backrefs-exclude.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Build environments that compile malicious Go packages using cgo are exposed, because the code can execute during linking. The ld.bfd-specific behavior applies when GNU ld.bfd is the host linker.
What must an attacker control to exploit it?
An attacker must supply or cause a build to use a malicious package containing cgo linker flags. Exploitation relies on passing linker-script files or arguments that the compiler driver treats as positional linker input files.
What validation changes mitigate the issue?
The go command now requires a -Wl, prefix on the second token of split -Wl, flags, except for -Wl,-R. It also rejects references to linker-script files for the affected flags and disallows bare -Wl,--warn-backrefs-exclude.