{"id":138218,"date":"2025-06-25T17:11:58","date_gmt":"2025-06-25T15:11:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-paketnyh-menedzherah-nix-lix-i-guix"},"modified":"2025-06-25T17:11:58","modified_gmt":"2025-06-25T15:11:58","slug":"uyazvimosti-v-paketnyh-menedzherah-nix-lix-i-guix","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-paketnyh-menedzherah-nix-lix-i-guix","title":{"rendered":"Vulnerabilitetet n\u00eb menaxher\u00ebt e paketave Nix, Lix dhe Guix","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb menaxher\u00ebt e paketave GNU Guix, Nix dhe Lix jan\u00eb zbuluar vulnerabilitete (Nix, Guix, Lix) q\u00eb lejojn\u00eb ekzekutimin e kodit me privilegjet e p\u00ebrdoruesve n\u00ebn t\u00eb cilat ekzekutohen detyrat nd\u00ebrtuese (p.sh., nixbld* n\u00eb Nix\/Lix). K\u00ebto mund t\u00eb shfryt\u00ebzohen p\u00ebr t\u00eb shkruar t\u00eb dh\u00ebnat e tyre n\u00eb mjedisin e nd\u00ebrtimit dhe p\u00ebr t\u00eb b\u00ebr\u00eb ndryshime n\u00eb procesin e nd\u00ebrtimit. Problemet jan\u00eb t\u00eb pranishme n\u00eb proceset e prapme guix-daemon dhe nix-daemon, t\u00eb cilat p\u00ebrdoren p\u00ebr t\u00eb organizuar aksesin e p\u00ebrdoruesve t\u00eb pamund\u00ebsuar n\u00eb operacionet nd\u00ebrtuese. <\/p>\n
Vulnerabilities arise from the fact that full file paths were used instead of dirfd descriptors for accessing temporary build directories during certain operations, which allowed for the substitution of the build directory located in the hierarchy \/tmp (for example, \/tmp\/guix-build-PACKAGE-X.Y.drv-0). Incorrect use of dirfd in the recursive deletion function led to a race condition, allowing an attacker to substitute a symbolic link at the moment between the creation and the change of ownership of the build directory. In a successful attack, guix-daemon\/nix-daemon would change the owner of the file addressed by the symbolic link instead of switching the user for the build directory. <\/p>\n
Vulnerabilitetet jan\u00eb eliminuar n\u00eb p\u00ebrdit\u00ebsimet Lix 2.93, Nix 2.29 dhe Guix 1.4.0-38.0e79d5b. P\u00ebr t\u00eb shfryt\u00ebzuar vulnerabilitetet, sulmuesi duhet t\u00eb ket\u00eb mund\u00ebsin\u00eb e ekzekutimit t\u00eb pun\u00ebve t\u00eb nd\u00ebrtimit t\u00eb rast\u00ebsishme. P\u00ebr sulmin q\u00eb p\u00ebrdor vulnerabilitetin CVE-2025-46415, mjafton t\u00eb ket\u00eb mund\u00ebsin\u00eb e krijimit t\u00eb skedar\u00ebve n\u00eb katalogun \/tmp n\u00eb makin\u00ebn e nd\u00ebrtimit, nd\u00ebrsa p\u00ebr vulnerabilitetin CVE-2025-46416 \u00ebsht\u00eb e nevojshme t\u00eb ket\u00eb mund\u00ebsin\u00eb e ekzekutimit t\u00eb kodit n\u00eb kontekstin e hap\u00ebsir\u00ebs kryesore t\u00eb identifikator\u00ebve t\u00eb p\u00ebrdoruesve (pid namespace) dhe rrjetit (network namespace). \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"