Subject: bug#37744: closed (Re: bug#37744: Per-user profile directory hijack (CVE-2019-17365 for Nix))

From: [email-masked] (GNU bug Tracking System)
Date: Wed, 16 Oct 2019 21:42:04 +0000

Your bug report

#37744: Per-user profile directory hijack (CVE-2019-17365 for Nix)

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
37744: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=37744
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#37744: Per-user profile directory hijack (CVE-2019-17365 for Nix)
From: Ludovic Courtès <[email-masked]>
To: Tobias Geerinckx-Rice <[email-masked]>
Cc: [email-masked]
Date: Wed, 16 Oct 2019 23:41:41 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

I pushed the fix as 81c580c8664bfeeb767e2c47ea343004e88223c7, followed
by an updated of the ‘guix’ package in
e63b31443b29b7793e73ab04798220edc6e564fc.

Thanks everyone!

Ludo’.

Subject: Per-user profile directory hijack (CVE-2019-17365 for Nix)
From: Ludovic Courtès <[email-masked]>
To: [email-masked]
Date: Mon, 14 Oct 2019 09:47:35 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Hello Guix,

That the per-user profile directory is world-writable allows an attacker
to hijack code run by other users, as has been reported in the context
of Nix:

  https://www.openwall.com/lists/oss-security/2019/10/09/4

I believe it applies to Guix as well.

Nix people are tracking it here:

   https://github.com/NixOS/nix/pull/3134
   https://github.com/NixOS/nix/issues/509

Looks like we’ll need to do something similar to:
<https://github.com/NixOS/nix/pull/3136/commits/5a303093dcae1e5ce9212616ef18f2ca51020b0d>.

Thoughts?

Thanks,
Ludo’.