Re: Risk of local privilege escalation in GNU Guix

[Leo Famulari <leo () famulari name>]

On Thu, Mar 18, 2021 at 05:27:09PM -0400, Leo Famulari wrote:
> # Vulnerability
>
> The attack consists in having an unprivileged user spawn a build process, for 
> instance with `guix build`, that makes its build directory world-writable.  The 
> user then creates a hardlink to a root-owned file such as `/etc/shadow` in that
> build directory.  If the user passed the `--keep-failed` option and the build
> eventually fails, the daemon changes ownership of the whole build tree,
> including the hardlink, to the user.  At that point, the user has write access
> to the target file.

This is CVE-2021-27851.

We are very grateful for the invaluable assistance of CERT/CC in getting
this assigned.

Attachment: signature.asc
Description: