GNU Guix Flaws Enable Remote Privilege Escalation and Store Corruption

Multiple critical security flaws in GNU Guix could allow malicious substitute servers or network attackers to achieve remote privilege escalation, corrupt the Guix store, and potentially expose sensitive local files. The vulnerabilities affect the guix substitute helper used by guix-daemon, with separate issues also found in guix pull and guix time-machine. The Guix project urged […] The post GNU Guix Flaws Enable Remote Privilege Escalation and Store Corruption appeared first on Cyber Security News.

Multiple critical security flaws in GNU Guix could allow malicious substitute servers or network attackers to achieve remote privilege escalation, corrupt the Guix store, and potentially expose sensitive local files. The vulnerabilities affect the guix substitute helper used by guix-daemon, with separate issues also found in guix pull and guix time-machine. The Guix project urged all users to immediately upgrade both Guix and guix-daemon to commit 897832f374dcdc9eeaf19d01e70b9a92fccfc68c or later. Critical GNU Guix Vulnerabilities Every Guix deployment is affected, including systems where the daemon runs without root privileges, although impact is more severe when guix-daemon runs as root. The most serious vulnerability lies in restore-file, a procedure in Guix’s serialization code that unpacks downloaded binary substitutes. The function processed archive contents while the download was still in progress, before the complete archive hash had been verified. Because restore-file did not sufficiently validate malicious archive entries, a substitute server or a man-in-the-middle attacker impersonating one could write arbitrary files wherever the daemon user had write permissions. Guix stated that on systems running the daemon as root, this could include sensitive paths such as /etc/passwd, creating a path to remote privilege escalation. HTTPS does not fully protect against exploitation. Although Guix verifies certificates when downloading substitute archives, the metadata-fetching process for substitute information, known as narinfos, did not verify server certificates. An attacker could alter the substitute URL in metadata, redirecting downloads to an attacker-controlled endpoint. The archive would eventually fail integrity verification, but only after malicious contents had already been extracted. The vulnerable restore-file functionality also affects utilities including guix offload, guix archive --extract, and guix challenge when they process untrusted input. A second flaw in fetch-narinfos allowed an attacker-controlled substitute server to return metadata for a different authorized store item than the one requested. This could allow an attacker to cause Guix to install an outdated or insecure package in place of a valid alternative. A third issue allowed untrusted clients connecting to the default guix-daemon socket to provide file:// substitute URLs. Since the daemon could follow symbolic links and read local files, an attacker may be able to trigger reads of files accessible to the daemon user. If a file contained invalid narinfo data, Guix could return an error backtrace that exposed portions of the file to the local client. The issue could also enable interference with files exposed through /proc/PID/fd, depending on processes accessible to the daemon user. Separately, Guix developers fixed a path traversal issue in guix pull and guix time-machine. A malicious channel name could manipulate the cache key used during channel authentication, causing files to be created or overwritten in locations writable by the user running the command. The impact is primarily a denial-of-service risk because the written content is limited to Scheme comments and Git commit identifiers. Exploitation generally requires an attacker to control a channel file, such as through Guix’s remote channel-file mechanism. Patching and Mitigation Guix addressed the issues through 11 commits in pull request #9665. Fixes harden archive extraction, reject unsafe file:// URLs from untrusted sources, validate narinfo responses, and move substitute restoration into a temporary directory until integrity checks finish. Administrators should upgrade immediately and restart guix-daemon. As a short-term remote mitigation, users can pass --no-substitutes to the daemon or Guix commands, though this does not protect against local attackers and may complicate upgrades. Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google. The post GNU Guix Flaws Enable Remote Privilege Escalation and Store Corruption appeared first on Cyber Security News.