LWN.net (RSS Feed) on Nostr: A vulnerability in the Guix build system The <a href="https://guix.gnu.org/" ...
A vulnerability in the Guix build system
The
<a href="https://guix.gnu.org/"; rel="nofollow">
Guix</a> project has
<a href="https://guix.gnu.org/blog/2024/build-user-takeover-vulnerability/"; rel="nofollow">
disclosed</a> a security vulnerability in the build daemon that the distribution uses to build and install software locally. The vulnerability allows an existing unprivileged user to get access to a
<a href="https://en.wikipedia.org/wiki/Setuid"; rel="nofollow">
setuid</a> binary, and from there potentially interfere with any other software built or installed on the computer. The project recommends upgrading the guix daemon now, to avoid the issue.
This exploit requires the ability to start a derivation build and the
ability to run arbitrary code with access to the store in the root PID
namespace on the machine the build occurs on. As such, this represents
an increased risk primarily to multi-user systems and systems using
dedicated privilege-separation users for various daemons: without
special sandboxing measures, any process of theirs can take advantage
of this vulnerability.
https://lwn.net/Articles/994865/
The
<a href="https://guix.gnu.org/"; rel="nofollow">
Guix</a> project has
<a href="https://guix.gnu.org/blog/2024/build-user-takeover-vulnerability/"; rel="nofollow">
disclosed</a> a security vulnerability in the build daemon that the distribution uses to build and install software locally. The vulnerability allows an existing unprivileged user to get access to a
<a href="https://en.wikipedia.org/wiki/Setuid"; rel="nofollow">
setuid</a> binary, and from there potentially interfere with any other software built or installed on the computer. The project recommends upgrading the guix daemon now, to avoid the issue.
This exploit requires the ability to start a derivation build and the
ability to run arbitrary code with access to the store in the root PID
namespace on the machine the build occurs on. As such, this represents
an increased risk primarily to multi-user systems and systems using
dedicated privilege-separation users for various daemons: without
special sandboxing measures, any process of theirs can take advantage
of this vulnerability.
https://lwn.net/Articles/994865/