[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

bug#28751: GuixSD setuid-programs handling creates setuid binaries in th

From: Leo Famulari
Subject: bug#28751: GuixSD setuid-programs handling creates setuid binaries in the store
Date: Fri, 29 Dec 2017 18:09:53 -0500
User-agent: Mutt/1.9.2 (2017-12-15)

On Sun, Oct 08, 2017 at 09:54:22PM +0200, Ludovic Courtès wrote:
> address@hidden (Ludovic Courtès) skribis:
> > address@hidden (Ludovic Courtès) skribis:
> >
> >> On GuixSD, ‘activate-setuid-programs’ in (gnu build activation) would
> >> create setuid-root binaries under /gnu/store for all the programs listed
> >> under ‘setuid-programs’ in the ‘operating-system’ declaration.
> >
> > Fixed by
> > <https://git.savannah.gnu.org/cgit/guix.git/commit/?id=5e66574a128937e7f2fcf146d146225703ccfd5d>.
> Detailed announcement at:
>   https://lists.gnu.org/archive/html/guix-devel/2017-10/msg00090.html

FYI, this was assigned CVE-2017-1000455.

I just received the attached JSON from the Distributed Weakness Filing
project (DWF) in response to my CVE application.

I assume it will show up in the regular places (MITRE etc) eventually.

Having thought about this bug for a while, I think it was not too bad in
practice. The setuid executable files could be copied or preserved
somehow by an attacker whether they were in the store or in

Attachment: CVE-2017-1000455.json
Description: Text document

Attachment: signature.asc
Description: PGP signature

reply via email to

[Prev in Thread] Current Thread [Next in Thread]