| id: GO-2025-3750 | |
| modules: | |
| - module: std | |
| versions: | |
| - fixed: 1.23.10 | |
| - introduced: 1.24.0-0 | |
| - fixed: 1.24.4 | |
| vulnerable_at: 1.24.3 | |
| packages: | |
| - package: syscall | |
| goos: | |
| - windows | |
| symbols: | |
| - Open | |
| - package: os | |
| goos: | |
| - windows | |
| symbols: | |
| - OpenFile | |
| - Root.OpenFile | |
| derived_symbols: | |
| - Chdir | |
| - Chmod | |
| - Chown | |
| - CopyFS | |
| - Create | |
| - CreateTemp | |
| - File.ReadDir | |
| - File.Readdir | |
| - File.Readdirnames | |
| - Getwd | |
| - Lchown | |
| - Link | |
| - Lstat | |
| - Mkdir | |
| - MkdirAll | |
| - MkdirTemp | |
| - NewFile | |
| - Open | |
| - OpenInRoot | |
| - OpenRoot | |
| - Pipe | |
| - ReadDir | |
| - ReadFile | |
| - Remove | |
| - RemoveAll | |
| - Rename | |
| - Root.Create | |
| - Root.Lstat | |
| - Root.Mkdir | |
| - Root.Open | |
| - Root.OpenRoot | |
| - Root.Remove | |
| - Root.Stat | |
| - StartProcess | |
| - Stat | |
| - Symlink | |
| - Truncate | |
| - WriteFile | |
| - dirFS.Open | |
| - dirFS.ReadDir | |
| - dirFS.ReadFile | |
| - dirFS.Stat | |
| - rootFS.Open | |
| - rootFS.ReadDir | |
| - rootFS.ReadFile | |
| - rootFS.Stat | |
| - unixDirent.Info | |
| summary: Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall | |
| description: |- | |
| os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows | |
| systems when the target path was a dangling symlink. On Unix systems, OpenFile | |
| with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the | |
| target path was a symlink to a nonexistent location, OpenFile would create a | |
| file in that location. OpenFile now always returns an error when the O_CREATE | |
| and O_EXCL flags are both set and the target path is a symlink. | |
| credits: | |
| - Junyoung Park and Dong-uk Kim of KAIST Hacking Lab | |
| references: | |
| - fix: https://go.dev/cl/672396 | |
| - report: https://go.dev/issue/73702 | |
| - web: https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A | |
| cve_metadata: | |
| id: CVE-2025-0913 | |
| cwe: 'CWE-59: Improper Link Resolution Before File Access (''Link Following'')' | |
| source: | |
| id: go-security-team | |
| created: 2025-06-10T12:48:34.42046-04:00 | |
| review_status: REVIEWED |