PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Panicking the right way in Go

blog.trailofbits.com | blog | #web3 | #go | #tools | #dynamic-analysis | #blockchain | #race-detection | #panic-recovery
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

OnEdge catches a subtle Go bug: global state changes made before a panic survive recover(). The tool reduces detection to race analysis, spotting issues like partially applied blockchain transactions.
Published
Collected

Related coverage

research · aikido.dev
Graphalgo campaign spreads to Terraform providers and Go Modules
Go malware has appeared in two Terraform providers and two Go modules — the first observed abuse of Terraform providers. The Graphalgo Go port hides a hash-gated trigger with blockchain and Slack C2.
blog · blog.trailofbits.com
State divergence enables unauthorized access
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · blog.trailofbits.com
gosentry brings LibAFL-grade fuzzing to Go's native interface
gosentry is a Trail of Bits fork of the Go toolchain that keeps the standard testing.F harness while running go test -fuzz on LibAFL, adding struct-aware, grammar-based fuzzing and new bug detections.
blog · blog.trailofbits.com
Detect Go’s silent arithmetic bugs with go-panikint
go-panikint, a modified Go compiler from Trail of Bits, turns silent integer overflows into explicit panics; it uncovered a real overflow in Cosmos SDK RPC pagination, closing a fuzzing blind spot.
blog · blog.trailofbits.com
How we avoided side-channels in our new post-quantum Go cryptography libraries
Trail of Bits released constant-time pure Go implementations of the post-quantum signatures ML-DSA (FIPS-204) and SLH-DSA (FIPS-205), avoiding division and branch timing leaks like KyberSlash.
blog · blog.trailofbits.com
Unexpected security footguns in Go's parsers
Unexpected behaviors in Go's JSON, XML, and YAML parsers let attackers bypass authentication, evade authorization, and exfiltrate data—seen in HashiCorp Vault's CVE-2020-16250 and real engagements.
Back