Описание
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
A flaw was found in the Go standard library's file system operations on Windows. Scoped directory operations fail to properly restrict directory creation when processing Windows junction points (links redirecting to other folder locations) that point outside the designated root directory. An attacker can exploit this weakness to create directories outside the restricted boundary, bypassing intended directory confinement controls.
Отчет
Red Hat rates this flaw as LOW severity. A flaw was found in the Go standard library's scoped filesystem implementation (os.Root) on Windows. When Root.Mkdir or Root.MkdirAll is called and the final path component of the target is an NTFS junction that points to an empty location outside the designated root directory, the operation follows the junction and creates a directory outside the restricted boundary, bypassing the intended directory confinement. The issue only applies when the last path component is a junction (path/to/junction, but not path/junction/target), and only to Go programs running on Windows. Exploitation requires local filesystem access with standard unprivileged user privileges to plant the junction that a Go application using these scoped operations then targets; no user interaction is required. Successful exploitation allows an attacker to create unauthorized directories outside the root (low integrity impact), with no impact on confidentiality or availability, and without crossing security-authority boundaries. Red Hat products shipping the Go toolchain or Go-based components are recorded as affected, including Red Hat Enterprise Linux, Red Hat Enterprise Linux AI, Red Hat In-Vehicle OS, Red Hat OpenStack Platform, Red Hat AMQ, and Red Hat Edge Manager, among other streams. Because the impact is LOW, fixes in affected Red Hat streams are deferred and no update trackers are filed for this severity, while some streams outside full support scope are resolved as out of support scope; the residual risk is limited to Windows deployments of Go applications that rely on os.Root confinement in environments where untrusted local users can create NTFS junctions. Red Hat's LOW rating (CVSS 3.3, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) differs significantly from the CISA score of 9.8, which does not reflect the local access and privileges required to exploit this issue or its directory-creation-only consequence.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Ansible Automation Orchestrator 2026 | ansible-automation-platform/automation-orchestrator-rhel9-operator | Under investigation | ||
| Assisted Installer for Red Hat OpenShift Container Platform 2 | rhai/assisted-installer-rhel9 | Under investigation | ||
| AWS Load Balancer Operator | albo/aws-load-balancer-rhel8-operator | Under investigation | ||
| Builds for Red Hat OpenShift | openshift-builds/openshift-builds-waiters-rhel10 | Under investigation | ||
| Builds for Red Hat OpenShift | openshift-builds/openshift-builds-waiters-rhel9 | Under investigation | ||
| cert-manager Operator for Red Hat OpenShift | cert-manager/jetstack-cert-manager-rhel9 | Under investigation | ||
| Compliance Operator | compliance/openshift-compliance-operator-bundle | Under investigation | ||
| Confidential Compute Attestation | build-of-trustee/trustee-rhel9-operator | Under investigation | ||
| Cost Management Metrics Operator | costmanagement/costmanagement-metrics-rhel9-operator | Under investigation | ||
| Cost Management On Premise | costmanagement/costmanagement-ingress-rhel9 | Under investigation |
Показывать по
Дополнительная информация
Статус:
EPSS
3.3 Low
CVSS3
Связанные уязвимости
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
Root.Mkdir(All) can follow junctions out of the root on Windows in os
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a juncti ...
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
EPSS
3.3 Low
CVSS3