Vulnerabilities (CVE not assigned) have been identified in the package manager Guix in the implementation of the internal command "guix substitute," which is automatically invoked by the background process guix-daemon during package installation operations. This command is used to download pre-compiled binary packages from external servers, verifying their integrity using a digital signature. The most dangerous vulnerability allows remote code execution on the user's system with the permissions under which the background process guix-daemon runs.
The issue affects all configurations with the guix-daemon process, regardless of whether it is run with root privileges or under an unprivileged user. To exploit the vulnerability, any attempt to download pre-compiled binary packages from server, controlled by the attacker, is sufficient. The malicious server does not have to be explicitly chosen or specified in the user's settings—it can be designated using the "--discover" option, allowing substitution of the server during a MITM attack. In configurations where guix-daemon runs with elevated privileges, a local user can carry out an attack if they can connect to the background process via a Unix socket (which is by default accessible to all users).
The vulnerability is present in the "restore-file" handler, which is used for unpacking as the package is being downloaded, without waiting for its complete download and verification of the downloaded archive via the digital signature. The issue arises from the lack of checking for the presence of the characters ".", "\/" and ".." in the file paths located in the archive. By substituting incorrect file names in the archive, an attacker can achieve arbitrary file writing in any area of the file system, subject to the permissions under which the background process guix-daemon runs.
To execute their code in the system, for example, an attacker may add an auto-executable script such as "~\/bashrc" or "~\/profile," or modify the "~\/ssh\/authorized_keys" file containing SSH keys. If guix-daemon runs under the root user in a multi-user system, the attacker could overwrite the password file or system scripts.
The potential for creating rogue servers to distribute malicious packages arose because the metadata loading procedure (narinfo) for available binary packages (fetch-narinfos) did not perform server certificate verification, relying instead on the fact that most of the metadata is signed with a digital signature. It turned out that the signature did not cover the URL for downloading the package, allowing it to be substituted without compromising the integrity of the metadata. Ultimately, the rogue package would be discarded due to failing the content check against the hash signed with the digital signature, but this check occurred after the unpacking stage, where issues with special characters in file names manifested.
In addition to the 'guix substitute' command, the vulnerable 'restore-file' handler is also involved in the operations of the 'guix offload', 'guix archive —extract', and 'guix challenge' commands, through which the vulnerability can also be exploited. As a workaround to block the vulnerability, it is recommended to explicitly specify the '—no-substitutes' option in all guix commands. The vulnerability fix has been incorporated into the Guix codebase. Users are advised to promptly install the updates generated by the developers for guix and guix-daemon.
Besides the identified issue in Guix, three other vulnerabilities have been addressed:
- The possibility of substituting binary packages due to the lack of verification of the requested package against the returned metadata in the fetch-narinfos handler. This vulnerability can be exploited to serve an outdated version of the requested package that contains vulnerabilities.
- Determining the content of the first line of arbitrary files in the system through a request with the URI 'file://' sent by a local user ('—substitute-urls file:///etc/shadow'). If guix-daemon is running with root privileges, it will read the requested file, determine that it is not metadata, and output an error message that will mention the line that could not be parsed.
- Specifying a specially formatted name for an external repository ("..\/..\/..\/..\/newfile") when executing the commands "guix pull" and "guix time-machine" allows one to write data with commit information to any existing file in the file system, provided its content resembles a list of strings in the Scheme language. This vulnerability could potentially be used for DoS attacks, but it is also possible that clever manipulations with the pseudo-filesystem \/proc could lead to more dangerous system manipulations.
Source: opennet.ru
