GNU bug report logs - #37744
Insecure permissions on /var/guix/profiles/per-user (CVE-2019-18192)

Previous Next

Full log

Message #15 received at 37744 <at> debbugs.gnu.org (full text, mbox):

From: Tobias Geerinckx-Rice <me <at> tobias.gr>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 37744 <at> debbugs.gnu.org, GNU Guix maintainers <guix-maintainers <at> gnu.org>,
 guix-security <at> gnu.org
Subject: Re: bug#37744: Per-user profile directory hijack (CVE-2019-17365 for
 Nix)
Date: Mon, 14 Oct 2019 13:53:35 +0200

[Message part 1 (text/plain, inline)]

Ludo',

Thanks for your report :-p

The 1777 is obviously very bad, no question.  However: question:

Ludovic Courtès 写道：
> I don’t see how to let the daemon create ‘per-user/$USER’ on 
> behalf of
> the client for clients connecting over TCP.  Or we’d need to add 
> a
> challenge mechanism or authentication.

I need more cluebat please: say I'm an attacker and connect to 
your daemon (over TCP, why not), asking it to create an empty 
‘per-user/ludo’.

Assuming the daemon creates it with sane permissions (say 0755) & 
without any race conditions, what's my evil plan now?

Kind regards,

T G-R

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.