From a4d15867c387d14f4d500bfdf11d94b3a9e0b900 Mon Sep 17 00:00:00 2001 From: Damien Neil Date: Tue, 12 Apr 2022 13:38:17 -0700 Subject: [PATCH] [go-1.15.15-eks] syscall: check correct group in Faccessat # AWS EKS Backported To: go-1.15.15-eks Backported On: Thu, 22 Sept 2022 Backported By: budris@amazon.com Backported From: release-branch.go1.17 EKS Patch Source Commit: https://github.com/danbudris/go/commit/a4d15867c387d14f4d500bfdf11d94b3a9e0b900 Upstream Source Commit: https://github.com/golang/go/commit/04781d14d2d33acbaf70f77e3a58ae0f3c90757c Fixes: CVE-2022-29526 # Original Information The Faccessat call checks the user, group, or other permission bits of a file to see if the calling process can access it. The test to see if the group permissions should be used was made with the wrong group id, using the process's group id rather than the file's group id. Fix this to use the correct group id. No test since we cannot easily change file permissions when not running as root and the test is meaningless if running as root. For #52313 Fixes #52439 Change-Id: I4e2c84754b0af7830b40fd15dedcbc58374d75ee Reviewed-on: https://go-review.googlesource.com/c/go/+/399539 Reviewed-by: Ian Lance Taylor Run-TryBot: Ian Lance Taylor TryBot-Result: Gopher Robot (cherry picked from commit f66925e854e71e0c54b581885380a490d7afa30c) Reviewed-on: https://go-review.googlesource.com/c/go/+/401078 Auto-Submit: Tatiana Bradley Run-TryBot: Tatiana Bradley Run-TryBot: Damien Neil Auto-Submit: Damien Neil Reviewed-by: Tatiana Bradley --- src/syscall/syscall_linux.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/syscall/syscall_linux.go b/src/syscall/syscall_linux.go index 07fe6a6c2b..dbf16d9af2 100644 --- a/src/syscall/syscall_linux.go +++ b/src/syscall/syscall_linux.go @@ -106,7 +106,7 @@ func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) { gid = Getgid() } - if uint32(gid) == st.Gid || isGroupMember(gid) { + if uint32(gid) == st.Gid || isGroupMember(int(st.Gid)) { fmode = (st.Mode >> 3) & 7 } else { fmode = st.Mode & 7 -- 2.30.1 (Apple Git-130)