CVE-2021-27851

A security vulnerability that can lead to local privilege escalation has been found in ’guix-daemon’. It affects multi-user setups in which ’guix-daemon’ runs locally. The attack consists in having an unprivileged user spawn a build process, for instance with guix build, that makes its build...

CVE-2021-27851 Local privilege escalation in GNU Guix via guix-daemon and '--keep-failed'

A security vulnerability that can lead to local privilege escalation has been found in ’guix-daemon’. It affects multi-user setups in which ’guix-daemon’ runs locally. The attack consists in having an unprivileged user spawn a build process, for instance with guix build, that makes its build...

CVE-2021-27851

CVE-2021-27851 affects the guix-daemon in multi-user setups. An unprivileged user can spawn a build (e.g., via guix build) that creates a world-writable build directory, then link a root-owned file (such as /etc/shadow). If the build later fails and the user used --keep-failed, the daemon can cha...

CVE-2021-27851

A security vulnerability that can lead to local privilege escalation has been found in ’guix-daemon’. It affects multi-user setups in which ’guix-daemon’ runs locally. The attack consists in having an unprivileged user spawn a build process, for instance with "guix build", that makes its build...

CVE-2021-27851

A security vulnerability that can lead to local privilege escalation has been found in ’guix-daemon’. It affects multi-user setups in which ’guix-daemon’ runs locally. The attack consists in having an unprivileged user spawn a build process, for instance with guix build, that makes its build...

GNU Guix Postback Link Vulnerability

GNU Guix is an open source, cross-platform package manager for the GNU community. A backlink vulnerability exists in GNU guix-daemon that allows an unprivileged user to spawn a build process...

CVE-2021-27851: Improper Link Resolution Before File Access

A security vulnerability that can lead to local privilege escalation has been found in ’guix-daemon’. It affects multi-user setups in which ’guix-daemon’ runs locally. The attack consists in having an unprivileged user spawn a build process, for instance with guix build, that makes its build...

PT-2021-17638

Name of the Vulnerable Software and Affected Versions: guix-daemon versions prior to v1.2.0-75109-g94f0312546 guix-daemon versions v0.11.0-3298-g2608e40988 and later Description: A security issue has been discovered that can lead to local privilege escalation. It affects multi-user setups where...

Privilege Escalation

bullseye is vulnerable to privilege escalation.The attack consists in having an unprivileged user spawn a build process, for instance with guix build, that makes its build directory world-writable. The user then creates a hardlink to a root-owned file such as /etc/shadow in that build directory. ...

CVE-2021-27851

A security vulnerability that can lead to local privilege escalation has been found in ’guix-daemon’. It affects multi-user setups in which ’guix-daemon’ runs locally. The attack consists in having an unprivileged user spawn a build process, for instance with guix build, that makes its build...

Unspecified Vulnerability in GNU Guix

GNU Guix is an open source, cross-platform package manager from the GNU Project. A security vulnerability in GNU Guix version 1.0.1, which stems from the parent directory of the user profile directory being globally writable, can be exploited by a local attacker to gain access to arbitrary users...

CVE-2019-18192

GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365...

CVE-2019-18192

GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365...

Code injection

GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365...

CVE-2019-18192

GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365...

CVE-2019-18192

GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365...

CVE-2019-18192

CVE-2019-18192 affects GNU Guix 1.0.1. Local users can gain access to arbitrary user accounts because the parent directory of user-profile directories is world-writable, a condition similar to CVE-2019-17365. Red Hat and CNVD entries corroborate the same underlying issue. The available references...

GNU Guix CVE-2019-18192 Local Privilege Escalation Vulnerability

Description GNU Guix is prone to a local privilege-escalation vulnerability. An attacker may exploit this issue to gain elevated privileges. Successful exploits may aid in further attacks. GNU Guix version 1.0.1 is vulnerable; other versions may also be affected. Technologies Affected GNU Guix...

CVE-2019-18192: Incorrect Permission Assignment for Critical Resource

GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365...

PT-2019-15265

Name of the Vulnerable Software and Affected Versions GNU Guix version 1.0.1 Description The issue allows local users to gain access to an arbitrary user's account. This is because the parent directory of the user-profile directories is world writable, which poses a security risk. Recommendations...