CVE-2021-27851

{"containers": {"cna": {"affected": [{"product": "guix-daemon", "vendor": "GNU Guix", "versions": [{"lessThan": "unspecified", "status": "affected", "version": "v0.11.0-3298-g2608e40988", "versionType": "custom"}, {"lessThan": "v1.2.0-75109-g94f0312546", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Nathan Nye of WhiteBeam Security"}], "datePublic": "2021-03-18T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A security vulnerability that can lead to local privilege escalation has been found in \u2019guix-daemon\u2019. It affects multi-user setups in which \u2019guix-daemon\u2019 runs locally. The attack consists in having an unprivileged user spawn a build process, for instance with `guix build`, that makes its build directory world-writable. The user then creates a hardlink to a root-owned file such as /etc/shadow in that build directory. If the user passed the --keep-failed option and the build eventually fails, the daemon changes ownership of the whole build tree, including the hardlink, to the user. At that point, the user has write access to the target file. Versions after and including v0.11.0-3298-g2608e40988, and versions prior to v1.2.0-75109-g94f0312546 are vulnerable."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-264", "description": "CWE-264 Permissions, Privileges, and Access Controls", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-04-26T15:35:28.000Z", "orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://guix.gnu.org/en/blog/2021/risk-of-local-privilege-escalation-via-guix-daemon/"}, {"tags": ["x_refsource_MISC"], "url": "https://bugs.gnu.org/47229"}], "source": {"discovery": "UNKNOWN"}, "title": "Local privilege escalation in GNU Guix via guix-daemon and '--keep-failed'", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cert@cert.org", "DATE_PUBLIC": "2021-03-18T00:00:00.000Z", "ID": "CVE-2021-27851", "STATE": "PUBLIC", "TITLE": "Local privilege escalation in GNU Guix via guix-daemon and '--keep-failed'"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "guix-daemon", "version": {"version_data": [{"version_affected": ">=", "version_value": "v0.11.0-3298-g2608e40988"}, {"version_affected": "<", "version_value": "v1.2.0-75109-g94f0312546"}]}}]}, "vendor_name": "GNU Guix"}]}}, "credit": [{"lang": "eng", "value": "Nathan Nye of WhiteBeam Security"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A security vulnerability that can lead to local privilege escalation has been found in \u2019guix-daemon\u2019. It affects multi-user setups in which \u2019guix-daemon\u2019 runs locally. The attack consists in having an unprivileged user spawn a build process, for instance with `guix build`, that makes its build directory world-writable. The user then creates a hardlink to a root-owned file such as /etc/shadow in that build directory. If the user passed the --keep-failed option and the build eventually fails, the daemon changes ownership of the whole build tree, including the hardlink, to the user. At that point, the user has write access to the target file. Versions after and including v0.11.0-3298-g2608e40988, and versions prior to v1.2.0-75109-g94f0312546 are vulnerable."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-264 Permissions, Privileges, and Access Controls"}]}]}, "references": {"reference_data": [{"name": "https://guix.gnu.org/en/blog/2021/risk-of-local-privilege-escalation-via-guix-daemon/", "refsource": "MISC", "url": "https://guix.gnu.org/en/blog/2021/risk-of-local-privilege-escalation-via-guix-daemon/"}, {"name": "https://bugs.gnu.org/47229", "refsource": "MISC", "url": "https://bugs.gnu.org/47229"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T21:33:15.927Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://guix.gnu.org/en/blog/2021/risk-of-local-privilege-escalation-via-guix-daemon/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugs.gnu.org/47229"}]}]}, "cveMetadata": {"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "assignerShortName": "certcc", "cveId": "CVE-2021-27851", "datePublished": "2021-04-26T15:35:28.989Z", "dateReserved": "2021-03-01T00:00:00.000Z", "dateUpdated": "2024-09-17T02:11:05.201Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "guix-daemon", "vendor": "GNU Guix", "versions": [{"lessThan": "unspecified", "status": "affected", "version": "v0.11.0-3298-g2608e40988", "versionType": "custom"}, {"lessThan": "v1.2.0-75109-g94f0312546", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "cret@cert.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gnu:guix:*:*:*:*:*:*:*:*", "matchCriteriaId": "D489F131-C780-45C0-99CF-B59532F60807", "versionEndExcluding": "1.2.0", "versionStartIncluding": "0.11.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability that can lead to local privilege escalation has been found in \u2019guix-daemon\u2019. It affects multi-user setups in which \u2019guix-daemon\u2019 runs locally. The attack consists in having an unprivileged user spawn a build process, for instance with `guix build`, that makes its build directory world-writable. The user then creates a hardlink to a root-owned file such as /etc/shadow in that build directory. If the user passed the --keep-failed option and the build eventually fails, the daemon changes ownership of the whole build tree, including the hardlink, to the user. At that point, the user has write access to the target file. Versions after and including v0.11.0-3298-g2608e40988, and versions prior to v1.2.0-75109-g94f0312546 are vulnerable."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad de seguridad en \"guix-daemon\" que puede conllevar a una escalada de privilegios local.&#xa0;Afecta a las configuraciones multiusuario en las que \"guix-daemon\" se ejecuta localmente.&#xa0;El ataque consiste en hacer que un usuario no privilegiado genere un proceso de compilaci\u00f3n, por ejemplo con \"guix build\", que hace que su directorio de compilaci\u00f3n sea world-writable.&#xa0;Luego, el usuario crea un v\u00ednculo f\u00edsico a un archivo de propiedad root tal y como /etc/shadow en ese directorio de compilaci\u00f3n.&#xa0;Si el usuario pas\u00f3 la opci\u00f3n --keep-failed y finalmente se produce un fallo en la compilaci\u00f3n, el demonio cambia la propiedad de todo el \u00e1rbol de compilaci\u00f3n, incluido el enlace f\u00edsico, al usuario.&#xa0;En ese momento, el usuario tiene acceso de escritura al archivo de destino.&#xa0;Las versiones posteriores a la v0.11.0-3298-g2608e40988 y las versiones anteriores a la v1.2.0-75109-g94f0312546 son vulnerables"}], "id": "CVE-2021-27851", "lastModified": "2026-06-17T03:45:30.917", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-04-26T16:15:07.433", "references": [{"source": "cret@cert.org", "tags": ["Issue Tracking", "Mailing List", "Patch", "Vendor Advisory"], "url": "https://bugs.gnu.org/47229"}, {"source": "cret@cert.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://guix.gnu.org/en/blog/2021/risk-of-local-privilege-escalation-via-guix-daemon/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Mailing List", "Patch", "Vendor Advisory"], "url": "https://bugs.gnu.org/47229"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://guix.gnu.org/en/blog/2021/risk-of-local-privilege-escalation-via-guix-daemon/"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "cret@cert.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-59"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}