unofficial mirror of guix-devel@gnu.org 
 help / color / mirror / code / Atom feed
* "Trojan Source" (CVE-2021-42574 and CVE-2021-42694): can 'guix lint' help someway?
@ 2021-11-01 11:30 Giovanni Biscuolo
  2021-11-01 13:38 ` Leo Famulari
  2021-11-09 17:05 ` Ludovic Courtès
  0 siblings, 2 replies; 6+ messages in thread
From: Giovanni Biscuolo @ 2021-11-01 11:30 UTC (permalink / raw)
  To: guix-devel

[-- Attachment #1: Type: text/plain, Size: 2214 bytes --]

Hello,

as probably many of you have discovered, today was announced two new
vulnerabilities that exploits the "bidirectional override" Unicode
codepoints feature, making it possible to hide malicious source code in
comments and literal strings /if/ the code review tool (e.g. editor)
does not show this.

The details are published here: https://www.trojansource.codes/

Also see related CVEs:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42574
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42694

I know that mitigations and patching of compilers and interpreters must
be done upstream and not much can be done by Guix, but I'm asking /if/
Guix could help code reviewers enhancing its lint function.

For example, the Rust security advisory for rustc [1] states:

--8<---------------cut here---------------start------------->8---

## Mitigations 

[...] If you can't upgrade your compiler version, or your codebase also
includes non-Rust source code files, we recommend periodically checking
that the following codepoints are not present in your repository and
your dependencies: U+202A, U+202B, U+202C, U+202D, U+202E, U+2066,
U+2067, U+2068, U+2069.

## Timeline of events 

* 2021-07-25: we received the report and started working on a fix. 
* 2021-09-14: the date for the embargo lift (2021-11-01) is communicated to us. 
* 2021-10-17: performed an analysis of all the source code ever published to 
crates.io to check for the presence of this attack. 
* 2021-11-01: embargo lifts, the vulnerability is disclosed and Rust 1.56.1 is 
released. 

--8<---------------cut here---------------end--------------->8---

Is there a way for "guix lint" to check for the listed (other?)
"dangerous" codepoints and warn code reviewers?

Is it possible for the Guix community to start a coordinated effort to
analyze all the source code (ever?!?) published in out git repo to check
for the presence of this attack?

AFAIU there is not much Guix can do for the "Homoglyph attacks"
(CVE-2021-42694).

WDYT?

Happi hacking! Gio'


[1] https://www.openwall.com/lists/oss-security/2021/11/01/1

-- 
Giovanni Biscuolo

Xelera IT Infrastructures

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 849 bytes --]

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2021-11-16 10:07 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-11-01 11:30 "Trojan Source" (CVE-2021-42574 and CVE-2021-42694): can 'guix lint' help someway? Giovanni Biscuolo
2021-11-01 13:38 ` Leo Famulari
2021-11-01 15:04   ` Bengt Richter
2021-11-09 17:05 ` Ludovic Courtès
2021-11-15 17:20   ` zimoun
2021-11-16 10:06   ` Giovanni Biscuolo

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).