{"id":138218,"date":"2025-06-25T17:11:58","date_gmt":"2025-06-25T15:11:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-paketnyh-menedzherah-nix-lix-i-guix"},"modified":"2025-06-25T17:11:58","modified_gmt":"2025-06-25T15:11:58","slug":"uyazvimosti-v-paketnyh-menedzherah-nix-lix-i-guix","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-paketnyh-menedzherah-nix-lix-i-guix","title":{"rendered":"Vulnerabilities in the package managers Nix, Lix, and Guix.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Vulnerabilities have been identified in the package managers GNU Guix, Nix, and Lix (Nix, Guix, Lix) that allow code execution with the privileges of the users under which the build jobs run (e.g., nixbld* in Nix\/Lix). This can be exploited to write one's own data into the build environment and alter the build process. Issues exist within the background processes guix-daemon and nix-daemon, which are used to facilitate access for unprivileged users to build operations. <\/p>\n
Vulnerabilities arise from the fact that during certain operations to access temporary build directories, full file paths were used instead of dirfd descriptors, which allowed for the substitution of the build directory located in the \/tmp hierarchy (for example, \"\/tmp\/guix-build-PACKAGE-X.Y.drv-0\"). Incorrect use of dirfd in the recursive deletion function led to a race condition, allowing an attacker to replace a symbolic link at the moment between the creation and the change of ownership of the build directory. Upon successful attack, guix-daemon\/nix-daemon altered the owner of the file pointed to by the symbolic link instead of changing the user for the build directory. <\/p>\n
The vulnerabilities have been addressed in updates for Lix 2.93, Nix 2.29, and Guix 1.4.0-38.0e79d5b. To exploit these vulnerabilities, the attacker must have the capability to run arbitrary build jobs. For the attack exploiting vulnerability CVE-2025-46415, it is sufficient to have the ability to create files in the \/tmp directory on the build machine. For vulnerability CVE-2025-46416, executing code within the context of the main user ID (pid namespace) and network (network namespace) is required. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"