UBUNTU-CVE-2026-97033: Medium severity ubuntu/golang-1.10 vulnerability
Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives. Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and CRT startup objects to an attacker-controlled directory; "-target" in Clang falls back to executing target helper tools from the current working directory when not found in PATH; "-isysroot" and "-Wl,-syslibroot" can pass a regular file on disk to GNU ld.bfd, which interprets it as a positional linker script; and "-x" permitted specifying arbitrary compiler input languages beyond those supported by cgo. "--sysroot" and "-target" are now disallowed in "#cgo" flags, "-isysroot" and "-Wl,-syslibroot" are verified not to point to regular files, and "-x" is restricted to the C, C++, Objective-C, and assembler languages supported by cgo.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enforce these restrictions on flags permitted in #cgo directives to prevent malicious packages from executing arbitrary code at build time.
cgo = Disallow --sysroot and -target; verify that -isysroot and -Wl,-syslibroot do not point to regular files; restrict -x to C, C++, Objective-C, and assembler languages
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that build untrusted Go packages containing cgo directives are exposed. The affected Ubuntu package list includes golang-1.6, golang-1.8, golang-1.10, golang-1.13, golang-1.16, golang-1.18, golang-1.22, and golang-1.24.
What must an attacker control to execute code?
An attacker must be able to provide or modify a package that is built with cgo and includes malicious #cgo compiler or linker flags. Code execution occurs during the build process, rather than requiring the resulting package to be run.
Which cgo flags are relevant for triage?
Review #cgo directives for --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x. The issue involves attacker-controlled compiler resources or helper tools, regular files interpreted by GNU ld.bfd as linker scripts, and arbitrary compiler input languages.
What behavior is restricted by the fix?
The fix disallows --sysroot and -target in #cgo flags. It also rejects -isysroot and -Wl,-syslibroot when they point to regular files, and limits -x to C, C++, Objective-C, and assembler languages supported by cgo.