CVE-2024-52867: High severity gnu guix system distribution vulnerability
guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users before file metadata concerns (e.g., for setuid and setgid programs) are properly addressed. The vulnerability can be remediated within the product via certain pull, reconfigure, and restart actions. Both 5ab3c4c and 5582241 are needed to resolve the vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52867?
CVE-2024-52867 is considered a high-severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2024-52867?
To fix CVE-2024-52867, ensure that you upgrade to GNU Guix version 5ab3c4c or later as it contains the necessary patches.
Who is affected by CVE-2024-52867?
Any installations of GNU Guix prior to version 5ab3c4c are affected by CVE-2024-52867.
What happens if CVE-2024-52867 is exploited?
If exploited, CVE-2024-52867 can allow local users to escalate their privileges by accessing build outputs without proper checks.
When was CVE-2024-52867 disclosed?
CVE-2024-52867 was disclosed along with updates in early 2024, prompting developers to address the vulnerability.