AZL-113663: CVE-2026-97033 affecting package tensorflow 2.16.1-11
Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives. Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and CRT startup objects to an attacker-controlled directory; "-target" in Clang falls back to executing target helper tools from the current working directory when not found in PATH; "-isysroot" and "-Wl,-syslibroot" can pass a regular file on disk to GNU ld.bfd, which interprets it as a positional linker script; and "-x" permitted specifying arbitrary compiler input languages beyond those supported by cgo. "--sysroot" and "-target" are now disallowed in "#cgo" flags, "-isysroot" and "-Wl,-syslibroot" are verified not to point to regular files, and "-x" is restricted to the C, C++, Objective-C, and assembler languages supported by cgo.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker needs to cause a package containing malicious #cgo directives to be built. The issue occurs at build time and can result in arbitrary code execution through permitted compiler or linker flags.
Which build configurations are most exposed?
Builds that compile untrusted or attacker-supplied packages using cgo are exposed. The described vectors rely on #cgo directives that influence compiler, linker, sysroot, target-helper, or input-language handling.
What mitigations are described if an update cannot be applied immediately?
Avoid building untrusted packages that use cgo directives. In particular, prevent use of --sysroot and -target, ensure -isysroot and -Wl,-syslibroot do not reference regular files, and restrict -x to C, C++, Objective-C, and assembler languages.
How can I assess whether a package is attempting to exploit this issue?
Inspect its #cgo directives for --sysroot, -target, -isysroot, -Wl,-syslibroot, or -x flags. Treat regular-file values supplied to -isysroot or -Wl,-syslibroot, arbitrary -x languages, and attacker-controlled sysroot or target-helper paths as suspicious.