PT-2024-35469 · Gnu Guix · Gnu Guix

Caleb Ristvedt · Published 2024-11-08 · Updated 2024-11-20 · CVE-2024-52867

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GNU Guix versions before 5ab3c4c

Description A privilege escalation issue exists because build outputs are accessible by local users before file metadata concerns, such as for setuid and setgid programs, are properly addressed. This issue can be remediated within the product via certain pull, reconfigure, and restart actions. Both 5ab3c4c and 5582241 are needed to resolve the issue.

Recommendations For GNU Guix versions before 5ab3c4c, perform the following actions to resolve the issue: Pull the necessary updates. Reconfigure the system. Restart the guix-daemon service. Ensure that both 5ab3c4c and 5582241 are applied to fully resolve the issue.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2024-52867

DLA-3959-1

DSA-5805-1

Affected Products

Gnu Guix

References · 21

• https://nvd.nist.gov/vuln/detail/CVE-2024-52867 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-52867 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-52867 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-52867 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5805-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-52867 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3959-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-52867 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52867 · Vendor Advisory
• https://twitter.com/oktsec/status/1858082068497862936 · Twitter Post
• https://guix.gnu.org/en/blog/2024/build-user-takeover-vulnerability · Note
• https://lists.debian.org/debian-lts-announce/2024/11/msg00016.html · Note
• https://t.me/cvenotify/102164 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1858045196153278469 · Twitter Post
• https://git.savannah.gnu.org/cgit/guix.git/commit/?id=5ab3c4c1e43ebb637551223791db0ea3519986e1 · Note