{"id":138218,"date":"2025-06-25T17:11:58","date_gmt":"2025-06-25T15:11:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-paketnyh-menedzherah-nix-lix-i-guix"},"modified":"2025-06-25T17:11:58","modified_gmt":"2025-06-25T15:11:58","slug":"uyazvimosti-v-paketnyh-menedzherah-nix-lix-i-guix","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-paketnyh-menedzherah-nix-lix-i-guix","title":{"rendered":"Vulnerabilit\u0103\u021bi \u00een managerii de pachete Nix, Lix \u0219i Guix","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen managerii de pachete GNU Guix, Nix \u0219i Lix au fost descoperite vulnerabilit\u0103\u021bi (Nix, Guix, Lix) care permit executarea de cod cu drepturile utilizatorilor sub care sunt rulate sarcinile de compilare (de exemplu, nixbld* \u00een Nix\/Lix), ceea ce poate fi folosit pentru a scrie date proprii \u00een mediul de compilare \u0219i a aduce modific\u0103ri \u00een procesul de compilare. Problemele sunt prezente \u00een procesele de fundal guix-daemon \u0219i nix-daemon, utilizate pentru a organiza accesul utilizatorilor f\u0103r\u0103 privilegii la opera\u021biunile de compilare. <\/p>\n

Vulnerabilit\u0103\u021bile sunt cauzate de faptul c\u0103, la executarea anumitor opera\u021biuni pentru accesarea directoarelor temporare de compilare, s-au folosit c\u0103i complete de fi\u0219iere \u00een loc de descriptorii dirfd, ceea ce permitea \u00eenlocuirea directorului de compilare situat \u00een ierarhia \/tmp (de exemplu, \"\/tmp\/guix-build-PACKAGE-X.Y.drv-0\"). Utilizarea incorect\u0103 a dirfd \u00een func\u021bia de \u0219tergere recursiv\u0103 ducea la o situa\u021bie de competi\u021bie, care permitea atacatorului s\u0103 \u00eenlocuiasc\u0103 un link simbolic \u00een momentul dintre crearea \u0219i modificarea proprietarului directorului de compilare. \u00cen cazul unui atac de succes, guix-daemon\/nix-daemon schimba, \u00een loc s\u0103 schimbe utilizatorul pentru directorul de compilare, proprietarul fi\u0219ierului adresat de linkul simbolic. <\/p>\n

Vulnerabilit\u0103\u021bile au fost remediate \u00een actualiz\u0103rile Lix 2.93, Nix 2.29 \u0219i Guix 1.4.0-38.0e79d5b. Pentru a exploata vulnerabilit\u0103\u021bile, atacatorul trebuie s\u0103 aib\u0103 capacitatea de a rula lucr\u0103ri de compilare arbitrare. Pentru un atac utiliz\u00e2nd vulnerabilitatea CVE-2025-46415 este suficient s\u0103 aib\u0103 posibilitatea de a crea fi\u0219iere \u00een directorul \/tmp pe ma\u0219ina de compilare, iar pentru vulnerabilitatea CVE-2025-46416 este necesar s\u0103 aib\u0103 capacitatea de a rula cod \u00een contextul spa\u021biului de nume de identificatori de utilizatori (pid namespace) \u0219i al re\u021belei (network namespace).
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0445 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430\u0445 GNU Guix, Nix \u0438 Lix \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u0438\u043e\u0441\u0442\u0438 (Nix, Guix, Lix), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043f\u043e\u0434 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0442\u0441\u044f \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u0435 \u0437\u0430\u0434\u0430\u043d\u0438\u044f (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, nixbld* \u0432 Nix\/Lix), \u0447\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0441\u0432\u043e\u0438\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u043e\u0435 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0438 \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u0444\u043e\u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u0445 guix-daemon \u0438 nix-daemon, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-138218","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u0103\u021bi \u00een managerii de pachete Nix, Lix \u0219i Guix | ProHoster","description":"\u00cen managerii de pachete GNU Guix, Nix \u0219i Lix au fost descoperite vulnerabilit\u0103\u021bi (Nix, Guix, Lix) care permit executarea de cod cu drepturile utilizatorilor sub care sunt rulate sarcinile de compilare (de exemplu, nixbld* \u00een Nix\/Lix), ceea ce poate.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-paketnyh-menedzherah-nix-lix-i-guix","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0445 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430\u0445 Nix, Lix \u0438 Guix | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0445 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430\u0445 GNU Guix, Nix \u0438 Lix \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u0438\u043e\u0441\u0442\u0438 (Nix, Guix, Lix), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043f\u043e\u0434 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0442\u0441\u044f \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u0435 \u0437\u0430\u0434\u0430\u043d\u0438\u044f (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, nixbld* \u0432 Nix\/Lix), \u0447\u0442\u043e \u043c\u043e\u0436\u0435\u0442.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-paketnyh-menedzherah-nix-lix-i-guix","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-06-25T15:11:58+00:00","article:modified_time":"2025-06-25T15:11:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"138218","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 13:28:33","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 13:28:33","updated":"2026-01-23 13:28:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/138218","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=138218"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/138218\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=138218"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=138218"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=138218"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}