cmd/go: cgo code injection [CVE-2023-29402]

[rolandshoemaker]

The go command may generate unexpected code at build time when using cgo. This
may result in unexpected behavior when running a go program which uses cgo.

This may occur when running an untrusted module which contains directories with
newline characters in their names. Modules which are retrieved using the go command,
i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e.
GO111MODULE=off, may be affected).

Thanks to Juho Nurminen of Mattermost for reporting this issue.

This is a PRIVATE issue for CVE-2023-29402, tracked in http://b/280799945

/cc @golang/security and @golang/release

[rolandshoemaker]

@gopherbot please open backport issues.

[gopherbot]

Backport issue(s) opened: #60515 (for 1.19), #60516 (for 1.20).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[gopherbot]

Change https://go.dev/cl/501218 mentions this issue: [release-branch.go1.19] cmd/go: disallow package directories containing newlines

[gopherbot]

Change https://go.dev/cl/501222 mentions this issue: [release-branch.go1.20] cmd/go: disallow package directories containing newlines

[gopherbot]

Change https://go.dev/cl/501226 mentions this issue: cmd/go: disallow package directories containing newlines