PT-2021-17638 · Unknown · Guix-Daemon

Nathan Nye · Published 2021-04-26 · Updated 2024-06-15 · CVE-2021-27851

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: guix-daemon versions prior to v1.2.0-75109-g94f0312546 guix-daemon versions v0.11.0-3298-g2608e40988 and later

Description: A security issue has been discovered that can lead to local privilege escalation. It affects multi-user setups where guix-daemon runs locally. The attack involves an unprivileged user creating a build process, making its build directory world-writable, and then creating a hardlink to a root-owned file, such as /etc/shadow, in that directory. If the build fails and the --keep-failed option is used, the daemon changes ownership of the build tree, including the hardlink, to the user, granting them write access to the target file.

Recommendations: For versions prior to v1.2.0-75109-g94f0312546, update to a version that includes the fix for this issue. For versions v0.11.0-3298-g2608e40988 and later, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the use of the guix build command with the --keep-failed option to prevent potential exploitation.

Fix

Link Following

Weakness Enumeration

CWE-59

CWE-264

Related Identifiers

CVE-2021-27851

OPENSUSE-SU-2024:10836-1

Affected Products

Guix-Daemon

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2021-27851 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27851 · Vendor Advisory
• https://bugs.gnu.org/47229 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-27851 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-27851 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-27851 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-27851 · Vendor Advisory
• https://guix.gnu.org/en/blog/2021/risk-of-local-privilege-escalation-via-guix-daemon · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-27851 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10836-1 · Vendor Advisory
• https://git.savannah.gnu.org/cgit/guix.git/commit/?id=ec7fb669945bfb47c5e1fdf7de3a5d07f7002ccf · Note
• https://issues.guix.gnu.org/47229 · Note
• https://suse.com/security/cve/CVE-2021-27851 · Note