Four vulnerabilities found in GNU Guix, including remote privilege escalation

The GNU Guix project has announced four vulnerabilities in its components. Three of them were found in the guix substitute utility, while another affects the guix pull and guix time-machine commands.

Vulnerabilities in guix substitute

The consequences range from remote privilege escalation to local disclosure of confidential files.

For remote exploitation, it is enough for a vulnerable system to attempt to download a binary substitute. The vulnerability can be exploited by any configured substitute server, including those discovered via the guix-daemon's --discover option, as well as by an attacker carrying out a man-in-the-middle (MITM) attack — regardless of whether https is used in the substitute server's URLs.

Local exploitation requires only the ability to connect to the guix-daemon socket, which by default is available to any user.

Vulnerability in guix pull and guix time-machine

A separate security issue (CVE identifier pending) was found in the guix pull and guix time-machine commands. It allows anyone who controls the channels file used by these commands to create or overwrite files anywhere the user running the command has the appropriate permissions.

Recommendations

The project recommends that all users update guix and guix-daemon immediately. The official announcement provides upgrade instructions, ways to check a system for the vulnerabilities, a disclosure timeline and other details.

Source: LWN.net