all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
* bug#37744: Per-user profile directory hijack (CVE-2019-17365 for Nix)
@ 2019-10-14  7:47 Ludovic Courtès
  2019-10-14  7:58 ` Ludovic Courtès
  0 siblings, 1 reply; 34+ messages in thread
From: Ludovic Courtès @ 2019-10-14  7:47 UTC (permalink / raw)
  To: 37744; +Cc: GNU Guix maintainers, guix-security

Hello Guix,

That the per-user profile directory is world-writable allows an attacker
to hijack code run by other users, as has been reported in the context
of Nix:

  https://www.openwall.com/lists/oss-security/2019/10/09/4

I believe it applies to Guix as well.

Nix people are tracking it here:

   https://github.com/NixOS/nix/pull/3134
   https://github.com/NixOS/nix/issues/509

Looks like we’ll need to do something similar to:
<https://github.com/NixOS/nix/pull/3136/commits/5a303093dcae1e5ce9212616ef18f2ca51020b0d>.

Thoughts?

Thanks,
Ludo’.

^ permalink raw reply	[flat|nested] 34+ messages in thread

end of thread, other threads:[~2019-10-19  1:33 UTC | newest]

Thread overview: 34+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-10-14  7:47 bug#37744: Per-user profile directory hijack (CVE-2019-17365 for Nix) Ludovic Courtès
2019-10-14  7:58 ` Ludovic Courtès
2019-10-14 11:53   ` Tobias Geerinckx-Rice via Bug reports for GNU Guix
2019-10-14 16:37     ` Maxim Cournoyer
2019-10-15 12:34     ` Ludovic Courtès
2019-10-15 14:31       ` Tobias Geerinckx-Rice via Bug reports for GNU Guix
2019-10-16  6:57         ` Ludovic Courtès
2019-10-16 10:22           ` Ludovic Courtès
2019-10-16 13:25             ` Ludovic Courtès
2019-10-16 14:22               ` pelzflorian (Florian Pelz)
2019-10-16 15:16                 ` Tobias Geerinckx-Rice via Bug reports for GNU Guix
2019-10-16 15:19                   ` pelzflorian (Florian Pelz)
2019-10-16 15:23                     ` Tobias Geerinckx-Rice via Bug reports for GNU Guix
2019-10-16 17:05                       ` Ludovic Courtès
2019-10-16 19:50                         ` Tobias Geerinckx-Rice via Bug reports for GNU Guix
2019-10-16 19:55                           ` Tobias Geerinckx-Rice via Bug reports for GNU Guix
2019-10-16 21:40                             ` Ludovic Courtès
2019-10-16 21:41                             ` Ludovic Courtès
2019-10-16 19:58                         ` Julien Lepiller
2019-10-16 21:38                           ` Ludovic Courtès
2019-10-16 15:37                 ` pelzflorian (Florian Pelz)
2019-10-16 21:39                   ` Ludovic Courtès
2019-10-17  2:58                     ` pelzflorian (Florian Pelz)
2019-10-17  3:01                       ` pelzflorian (Florian Pelz)
2019-10-16 20:28               ` Ludovic Courtès
2019-10-17 16:18               ` Ludovic Courtès
2019-10-17 19:01                 ` Tobias Geerinckx-Rice via Bug reports for GNU Guix
2019-10-17 20:25                   ` Ludovic Courtès
2019-10-18  2:21                     ` Bengt Richter
2019-10-18 14:36                       ` Ludovic Courtès
2019-10-19  1:32                         ` Bengt Richter
2019-10-16 14:12             ` Tobias Geerinckx-Rice via Bug reports for GNU Guix
2019-10-16 20:01               ` Ludovic Courtès
2019-10-16 16:28             ` Julien Lepiller

Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.