On Sun, Oct 08, 2017 at 09:54:22PM +0200, Ludovic Courtès wrote: > [email protected] (Ludovic Courtès) skribis: > > > [email protected] (Ludovic Courtès) skribis: > > > >> On GuixSD, ‘activate-setuid-programs’ in (gnu build activation) would > >> create setuid-root binaries under /gnu/store for all the programs listed > >> under ‘setuid-programs’ in the ‘operating-system’ declaration. > > > > Fixed by > > <https://git.savannah.gnu.org/cgit/guix.git/commit/?id=5e66574a128937e7f2fcf146d146225703ccfd5d>. > > Detailed announcement at: > > https://lists.gnu.org/archive/html/guix-devel/2017-10/msg00090.html
FYI, this was assigned CVE-2017-1000455. I just received the attached JSON from the Distributed Weakness Filing project (DWF) in response to my CVE application. I assume it will show up in the regular places (MITRE etc) eventually. Having thought about this bug for a while, I think it was not too bad in practice. The setuid executable files could be copied or preserved somehow by an attacker whether they were in the store or in /run/setuid-programs.
{"data_version": "4.0","references": {"reference_data": [{"url":
"https://lists.gnu.org/archive/html/guix-devel/2017-10/msg00090.html"}]},"description":
{"description_data": [{"lang": "eng","value": "GuixSD prior to Git commit
5e66574a128937e7f2fcf146d146225703ccfd5d used POSIX hard links incorrectly,
leading the creation of setuid executables in \"the store\", violating a
fundamental security assumption of GNU Guix."}]},"data_type": "CVE","affects":
{"vendor": {"vendor_data": [{"product": {"product_data": [{"version":
{"version_data": [{"version_value": "All versions of GuixSD prior to Git commit
5e66574a128937e7f2fcf146d146225703ccfd5d"}]},"product_name":
"GuixSD"}]},"vendor_name": "GNU Guix"}]}},"CVE_data_meta": {"DATE_ASSIGNED":
"2017-12-29","ID": "CVE-2017-1000455","ASSIGNER":
"[email protected]","REQUESTER": "[email protected]"},"data_format":
"MITRE","problemtype": {"problemtype_data": [{"description": [{"lang":
"eng","value": "Insecure Permissions"}]}]}}
signature.asc
Description: PGP signature
