CVE-2024-52867: High severity GNU Guix vulnerability
guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users before file metadata concerns (e.g., for setuid and setgid programs) are properly addressed. The vulnerability can be remediated within the product via certain pull, reconfigure, and restart actions. Both 5ab3c4c and 5582241 are needed to resolve the vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/guixto a version that resolves this vulnerability.Fixed in 1.4.0-9 - Upgrade
Upgrade
guix-daemon (GNU Guix)to a version that resolves this vulnerability.Fixed in 5ab3c4c - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 5582241 - Compensating control
Remediate within the product via the described pull, reconfigure, and restart actions so the fixed guix-daemon behavior is deployed.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52867?
CVE-2024-52867 is considered a high-severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2024-52867?
To fix CVE-2024-52867, ensure that you upgrade to GNU Guix version 5ab3c4c or later as it contains the necessary patches.
Who is affected by CVE-2024-52867?
Any installations of GNU Guix prior to version 5ab3c4c are affected by CVE-2024-52867.
What happens if CVE-2024-52867 is exploited?
If exploited, CVE-2024-52867 can allow local users to escalate their privileges by accessing build outputs without proper checks.
When was CVE-2024-52867 disclosed?
CVE-2024-52867 was disclosed along with updates in early 2024, prompting developers to address the vulnerability.