Описание
A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the build user (e.g., nixbld* or guixbuild*). This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| guix | unfixed | package |
Примечания
https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/
https://codeberg.org/guix/guix/pulls/788
https://codeberg.org/guix/guix/commit/7173c2c0cad8afc9d8d1ad26f345b5a04f47716a
https://codeberg.org/guix/guix/commit/be8aca065118aa4485c02f991c51bea89034defa
https://codeberg.org/guix/guix/commit/fb42611b8f27960304db5a1c0d33b8371dcde2a8
https://codeberg.org/guix/guix/commit/c659f977bb09de6d5615e6aa9efddedc1d9ff458
https://codeberg.org/guix/guix/commit/0e79d5b6550729e6ce3bac1e979638ac054ba5a5
https://codeberg.org/guix/guix/commit/30a5d140aa5a789a362749d057754783fea83dde
EPSS
Связанные уязвимости
A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the build user (e.g., nixbld* or guixbuild*). This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the build user (e.g., nixbld* or guixbuild*). This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the build user (e.g., nixbld* or guixbuild*). This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
Уязвимость пакетных менеджеров Nix, Lix и Guix, связанная с ошибками синхронизации при использовании общего ресурса, позволяющая нарушителю получить доступ на чтение и изменение данных
EPSS