Vulnerabilities (CVE not assigned) have been identified in the Guix package manager in the implementation of the internal "guix substitute" command, which is automatically invoked by the guix-daemon background process during package installations. The command is used to download pre-built binary packages from external servers and verify their integrity using a digital signature. The most severe vulnerability allows remote code execution on a user's system with the privileges under which the guix-daemon background process runs.
The issue affects all configurations with the guix-daemon process, regardless of whether it runs with root or unprivileged user rights. Exploitation of the vulnerability requires any attempt to download pre-built binary packages from Server, controlled by the attacker. In this case, the malicious server It doesn't have to be explicitly selected or specified in the user settings—it can be defined using the "--discover" option, which allows for server impersonation during a man-in-the-middle attack. In configurations where guix-daemon is running with elevated privileges, a local user can perform an attack if they can connect to the background process via a Unix socket (available to all users by default).
The vulnerability exists in the "restore-file" handler, which is used to unpack a package as it's being downloaded, without waiting for it to be fully downloaded and for the downloaded archive to be verified using a digital signature. The issue is caused by a lack of checks for the characters ".", "/," and ".." in file paths within the archive. By substituting invalid file names into the archive, an attacker can write an arbitrary file to any location in the file system, subject to the permissions under which the guix-daemon background process runs.
To execute your code on the system, for example, you can add an autorun script such as "~/.bashrc" or ~/.profile, or modify the ~/.ssh/authorized_keys file containing SSH keys. If guix-daemon runs as the root user on a multi-user system, an attacker can overwrite the password file or system scripts.
The ability to create fake servers for distributing malicious packages was due to the fact that the procedure for downloading metadata (narinfo) about available binary packages (fetch-narinfos) did not verify the server certificate, relying on the fact that most of the metadata was digitally signed. As it turned out, the signature did not cover the package download URL, allowing it to be spoofed without compromising the metadata's integrity. Ultimately, the fake package would have been rejected due to a failure to verify its contents against the digitally signed hash. However, this verification was performed after the unpacking stage, which revealed a problem with special characters in filenames.
In addition to the "guix substitute" command, the vulnerable "restore-file" handler is used by the "guix offload," "guix archive --extract," and "guix challenge" commands, which can also be used to exploit the vulnerability. As a workaround, explicitly specifying the "--no-substitutes" option in all guix commands is suggested. A fix for the vulnerability has been accepted into the Guix codebase. Users are advised to immediately install the developer-generated updates for guix and guix-daemon.
In addition to the issue noted, three more vulnerabilities have been fixed in Guix:
- Possibility of binary package spoofing due to a lack of verification of the requested package's compliance with the returned metadata in the fetch-narinfos handler. This vulnerability can be exploited to return an outdated version of the requested package containing vulnerabilities.
- Determining the contents of the first line of arbitrary files in the system by sending a request from a local user with the "file://" URI ("--substitute-urls file:///etc/shadow"). If guix-daemon is running with root privileges, it will read the requested file, determine that it is not metadata, and return an error message mentioning the line that could not be parsed.
- Specifying a specially crafted external repository name ("../../../../newfile") when executing the "guix pull" and "guix time-machine" commands allows commit information to be written to an arbitrary existing file in the file system if its contents resemble a list of Scheme strings. This vulnerability can be used for DoS attacks, but it's possible that more dangerous system manipulations can be achieved through clever manipulation of the /proc pseudo-filesystem.
Source: opennet.ru
