{"id":138218,"date":"2025-06-25T17:11:58","date_gmt":"2025-06-25T15:11:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-paketnyh-menedzherah-nix-lix-i-guix"},"modified":"2025-06-25T17:11:58","modified_gmt":"2025-06-25T15:11:58","slug":"uyazvimosti-v-paketnyh-menedzherah-nix-lix-i-guix","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-v-paketnyh-menedzherah-nix-lix-i-guix","title":{"rendered":"Vulnerabilities in package managers Nix, Lix, and Guix","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

W mened\u017cerach pakiet\u00f3w GNU Guix, Nix i Lix zidentyfikowano luki (Nix, Guix, Lix), kt\u00f3re umo\u017cliwiaj\u0105 wykonanie kodu z uprawnieniami u\u017cytkownik\u00f3w, pod kt\u00f3rymi uruchamiane s\u0105 zadania kompilacji (np. nixbld* w Nix\/Lix), co mo\u017ce by\u0107 wykorzystywane do zapisu w\u0142asnych danych w \u015brodowisku kompilacyjnym i wprowadzenia zmian w procesie kompilacji. Problemy wyst\u0119puj\u0105 w procesach w tle guix-daemon i nix-daemon, stosowanych do organizacji dost\u0119pu nieuprzywilejowanych u\u017cytkownik\u00f3w do operacji kompilacyjnych. <\/p>\n

Luki s\u0105 spowodowane tym, \u017ce podczas wykonywania niekt\u00f3rych operacji do uzyskania dost\u0119pu do tymczasowych katalog\u00f3w roboczych u\u017cywano pe\u0142nych \u015bcie\u017cek do plik\u00f3w zamiast deskryptor\u00f3w dirfd, co pozwala\u0142o na podmian\u0119 katalogu roboczego umieszczonego w hierarchii \/tmp (na przyk\u0142ad \u201e\/tmp\/guix-build-PACKAGE-X.Y.drv-0\u201d). Nieprawid\u0142owe u\u017cycie dirfd w funkcji rekurencyjnego usuwania prowadzi\u0142o do stanu wy\u015bcigu, w wyniku kt\u00f3rego atakuj\u0105cy m\u00f3g\u0142 wprowadzi\u0107 symboliczne odniesienie w chwili mi\u0119dzy tworzeniem a zmian\u0105 w\u0142a\u015bciciela katalogu roboczego. Przy udanej pr\u00f3bie guix-daemon\/nix-daemon zamiast zmiany u\u017cytkownika dla katalogu roboczego zmienia\u0142 w\u0142a\u015bciciela pliku adresowanego przez symboliczne odniesienie. <\/p>\n

Luki zosta\u0142y usuni\u0119te w aktualizacjach Lix 2.93, Nix 2.29 i Guix 1.4.0-38.0e79d5b. Aby wykorzysta\u0107 te luki, atakuj\u0105cy musi mie\u0107 mo\u017cliwo\u015b\u0107 uruchamiania dowolnych prac kompilacyjnych. Do ataku przy u\u017cyciu luki CVE-2025-46415 wystarczy mo\u017cliwo\u015b\u0107 tworzenia plik\u00f3w w katalogu \/tmp na maszynie kompilacyjnej, natomiast do luki CVE-2025-46416 konieczne jest posiadanie mo\u017cliwo\u015bci uruchamiania kodu w kontek\u015bcie g\u0142\u00f3wnej przestrzeni nazw identyfikator\u00f3w u\u017cytkownik\u00f3w (pid namespace) i sieci (network namespace).
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0445 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430\u0445 GNU Guix, Nix \u0438 Lix \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u0438\u043e\u0441\u0442\u0438 (Nix, Guix, Lix), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043f\u043e\u0434 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0442\u0441\u044f \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u0435 \u0437\u0430\u0434\u0430\u043d\u0438\u044f (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, nixbld* \u0432 Nix\/Lix), \u0447\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0441\u0432\u043e\u0438\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u043e\u0435 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0438 \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u0444\u043e\u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u0445 guix-daemon \u0438 nix-daemon, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-138218","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Luki w mened\u017cerach pakiet\u00f3w Nix, Lix i Guix | ProHoster","description":"W mened\u017cerach pakiet\u00f3w GNU Guix, Nix i Lix zidentyfikowano luki (Nix, Guix, Lix), kt\u00f3re umo\u017cliwiaj\u0105 wykonanie kodu z uprawnieniami u\u017cytkownik\u00f3w, pod kt\u00f3rymi uruchamiane s\u0105 zadania kompilacji (np. nixbld* w Nix\/Lix), co mo\u017ce.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-v-paketnyh-menedzherah-nix-lix-i-guix","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0445 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430\u0445 Nix, Lix \u0438 Guix | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0445 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430\u0445 GNU Guix, Nix \u0438 Lix \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u0438\u043e\u0441\u0442\u0438 (Nix, Guix, Lix), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043f\u043e\u0434 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0442\u0441\u044f \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u0435 \u0437\u0430\u0434\u0430\u043d\u0438\u044f (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, nixbld* \u0432 Nix\/Lix), \u0447\u0442\u043e \u043c\u043e\u0436\u0435\u0442.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-v-paketnyh-menedzherah-nix-lix-i-guix","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-06-25T15:11:58+00:00","article:modified_time":"2025-06-25T15:11:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"138218","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 13:28:33","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 13:28:33","updated":"2026-01-23 13:28:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/138218","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=138218"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/138218\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=138218"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=138218"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=138218"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}