{"id":182448,"date":"2026-07-03T22:53:39","date_gmt":"2026-07-03T20:53:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-paketnom-menedzhere-guix-dopuskayushhaya-udalyonnoe-vypolnenie-koda-v-sisteme"},"modified":"2026-07-03T22:53:39","modified_gmt":"2026-07-03T20:53:39","slug":"uyazvimost-v-paketnom-menedzhere-guix-dopuskayushhaya-udalyonnoe-vypolnenie-koda-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-paketnom-menedzhere-guix-dopuskayushhaya-udalyonnoe-vypolnenie-koda-v-sisteme","title":{"rendered":"Vulnerabilitet n\u00eb menaxherin e paketave Guix q\u00eb lejon ekzekutimin e kodit t\u00eb larg\u00ebt n\u00eb sistem.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb menaxherin e paketave Guix jan\u00eb zbuluar dob\u00ebsi sigurie (pa CVE t\u00eb caktuara) n\u00eb implementimin e komand\u00ebs s\u00eb brendshme «guix substitute», e cila thirret automatikisht nga procesi n\u00eb sfond guix-daemon gjat\u00eb operacioneve t\u00eb instalimit t\u00eb paketave. Kjo komand\u00eb p\u00ebrdoret p\u00ebr t\u00eb shkarkuar paketa binare tashm\u00eb t\u00eb nd\u00ebrtuara nga server\u00eb t\u00eb jasht\u00ebm, duke verifikuar integritetin e tyre me an\u00eb t\u00eb n\u00ebnshkrimit digjital. Dob\u00ebsia m\u00eb kritike lejon ekzekutimin n\u00eb distanc\u00eb t\u00eb kodit n\u00eb sistemin e p\u00ebrdoruesit me t\u00eb drejtat me t\u00eb cilat ekzekutohet procesi n\u00eb sfond guix-daemon. <\/p>\n

Problemi prek t\u00eb gjitha konfigurimet me procesin guix-daemon, pavar\u00ebsisht n\u00ebse ekzekutohet me t\u00eb drejta root apo n\u00ebn nj\u00eb p\u00ebrdorues pa privilegje. P\u00ebr shfryt\u00ebzimin e dob\u00ebsis\u00eb mjafton \u00e7do p\u00ebrpjekje p\u00ebr t\u00eb shkarkuar paketa binare t\u00eb gatshme nga server\u00eb<\/a>, i kontrolluar nga sulmuesi. N\u00eb k\u00ebt\u00eb rast, server<\/a> nuk \u00ebsht\u00eb e nevojshme t\u00eb zgjidhet ose t\u00eb p\u00ebrcaktohet shprehimisht n\u00eb cil\u00ebsimet e p\u00ebrdoruesit — ai mund t\u00eb zbulohet me an\u00eb t\u00eb opsionit «—discover», gj\u00eb q\u00eb mund\u00ebson z\u00ebvend\u00ebsimin e serverit gjat\u00eb nj\u00eb sulmi MITM. N\u00eb konfigurimet ku guix-daemon ekzekutohet me privilegje t\u00eb larta, nj\u00eb p\u00ebrdorues lokal mund ta kryej\u00eb sulmin n\u00ebse ka mund\u00ebsi t\u00eb lidhet me procesin n\u00eb sfond p\u00ebrmes Unix-socket (si parazgjedhje i aksesuesh\u00ebm p\u00ebr t\u00eb gjith\u00eb p\u00ebrdoruesit). <\/p>\n

Dob\u00ebsia ndodhet n\u00eb p\u00ebrpunuesin «restore-file», i cili p\u00ebrdoret p\u00ebr t\u00eb shpaketuar paket\u00ebn gjat\u00eb shkarkimit, pa pritur p\u00ebrfundimin e plot\u00eb t\u00eb shkarkimit dhe verifikimin e arkivit t\u00eb shkarkuar me n\u00ebnshkrim digjital. Problemi shkaktohet nga mungesa e kontrollit p\u00ebr pranin\u00eb e simboleve «.», «\/» dhe «..» n\u00eb shtigjet e skedar\u00ebve t\u00eb vendosur n\u00eb arkiv. Duke futur n\u00eb arkiv emra skedar\u00ebsh t\u00eb pasakt\u00eb, sulmuesi mund t\u00eb arrij\u00eb t\u00eb shkruaj\u00eb nj\u00eb skedar arbitrar n\u00eb \u00e7do pjes\u00eb t\u00eb sistemit t\u00eb skedar\u00ebve, aq sa e lejojn\u00eb t\u00eb drejtat me t\u00eb cilat ekzekutohet procesi n\u00eb sfond guix-daemon. <\/p>\n

P\u00ebr t\u00eb mund\u00ebsuar ekzekutimin e kodit t\u00eb vet n\u00eb sistem, p\u00ebr shembull, mund t\u00eb shtohet nj\u00eb skript q\u00eb nis automatikisht, si «~\/.bashrc» ose ~\/.profile, ose t\u00eb ndryshohet skedari ~\/.ssh\/authorized_keys me \u00e7el\u00ebsat SSH. N\u00ebse n\u00eb nj\u00eb sistem shum\u00ebp\u00ebrdorues guix-daemon ekzekutohet n\u00ebn p\u00ebrdoruesin root, sulmuesi mund t\u00eb mbishkruaj\u00eb skedarin e fjal\u00ebkalimeve ose skriptet e sistemit. <\/p>\n

Mund\u00ebsia p\u00ebr t\u00eb krijuar server\u00eb t\u00eb rrem\u00eb p\u00ebr shp\u00ebrndarjen e paketave keqdash\u00ebse u shkaktua nga fakti se procedura e shkarkimit t\u00eb metadata-ve (narinfo) p\u00ebr paketat binare t\u00eb disponueshme (fetch-narinfos) nuk verifikonte certifikat\u00ebn e serverit, duke u mb\u00ebshtetur te fakti q\u00eb pjesa kryesore e metadata-ve n\u00ebnshkruhet n\u00eb m\u00ebnyr\u00eb dixhitale. Si\u00e7 rezultoi, n\u00ebnshkrimi nuk e p\u00ebrfshinte URL-n\u00eb p\u00ebr shkarkimin e paket\u00ebs, gj\u00eb q\u00eb lejonte z\u00ebvend\u00ebsimin e saj pa cenuar integritetin e metadata-ve. N\u00eb fund, paketa e rreme do t\u00eb refuzohej p\u00ebr shkak se nuk kalonte verifikimin e p\u00ebrmbajtjes s\u00eb saj sipas hash-it t\u00eb v\u00ebrtetuar me n\u00ebnshkrim dixhital, por kjo verifikim kryhej pas faz\u00ebs s\u00eb shpaketimit, ku shfaqej problemi me simbolet speciale n\u00eb emrat e skedar\u00ebve. <\/p>\n

P\u00ebrve\u00e7 komand\u00ebs «guix substitute», p\u00ebrpunuesi i cenuesh\u00ebm «restore-file» p\u00ebrdoret edhe nga komandat «guix offload», «guix archive —extract» dhe «guix challenge», p\u00ebrmes t\u00eb cilave cenueshm\u00ebria gjithashtu mund t\u00eb shfryt\u00ebzohet. Si zgjidhje e p\u00ebrkohshme p\u00ebr bllokimin e cenueshm\u00ebris\u00eb, propozohet q\u00eb opsioni «—no-substitutes» t\u00eb specifikohet qart\u00eb n\u00eb t\u00eb gjitha komandat guix. Rregullimi i cenueshm\u00ebris\u00eb \u00ebsht\u00eb p\u00ebrfshir\u00eb tashm\u00eb n\u00eb baz\u00ebn e kodit t\u00eb Guix. P\u00ebrdoruesve u rekomandohet t\u00eb instalojn\u00eb pa vones\u00eb p\u00ebrdit\u00ebsimet e guix dhe guix-daemon t\u00eb p\u00ebrgatitura nga zhvilluesit. <\/p>\n

P\u00ebrve\u00e7 problemit t\u00eb p\u00ebrmendur, n\u00eb Guix jan\u00eb eliminuar edhe tre cenueshm\u00ebri t\u00eb tjera: <\/p>\n