漏洞标题
runtime 中的 setuid/setgid 二进制程序的不安全行为
漏洞描述信息
运行时setuid/setgid二进制文件中的不安全行为
CVSS信息
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
漏洞类别
初始化不恰当
漏洞标题
Unsafe behavior in setuid/setgid binaries in runtime
漏洞描述信息
On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Google Go 安全漏洞
漏洞描述信息
Google Go是美国谷歌（Google）公司的一种静态强类型、编译型、并发型，并具有垃圾回收功能的编程语言。 Google Go 1.19.10 之前版本、 1.20.0-0到1.20.5版本存在安全漏洞。攻击者利用该漏洞可以提升权限，从而读取或写入任意内容。
CVSS信息
N/A
漏洞类别
其他