Re: Risk of local privilege escalation in GNU Guix

[Leo Famulari <leo () famulari name>]

On Thu, Mar 18, 2021 at 05:27:09PM -0400, Leo Famulari wrote:
> # Vulnerability
>
> The attack consists in having an unprivileged user spawn a build process, for 
> instance with `guix build`, that makes its build directory world-writable.  The 
> user then creates a hardlink to a root-owned file such as `/etc/shadow` in that
> build directory.  If the user passed the `--keep-failed` option and the build
> eventually fails, the daemon changes ownership of the whole build tree,
> including the hardlink, to the user.  At that point, the user has write access
> to the target file.

We applied for a CVE ID via MITRE's web form [0] on March 18, 2021.

We have not yet received a reply. Does anybody know if that is expected?

Is there another method for independent projects to receive CVE IDs?

[0] https://cveform.mitre.org/

Attachment: signature.asc
Description: