GNU Guix
By the Year
In 2024 there have been 0 vulnerabilities in GNU Guix . Guix did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 0 | 0.00 |
| 2021 | 1 | 5.50 |
| 2020 | 0 | 0.00 |
| 2019 | 1 | 7.80 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Guix vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent GNU Guix Security Vulnerabilities
A security vulnerability that can lead to local privilege escalation has been found in guix-daemon
CVE-2021-27851
5.5 - Medium
- April 26, 2021
A security vulnerability that can lead to local privilege escalation has been found in guix-daemon. It affects multi-user setups in which guix-daemon runs locally. The attack consists in having an unprivileged user spawn a build process, for instance with `guix build`, that makes its build directory world-writable. The user then creates a hardlink to a root-owned file such as /etc/shadow in that build directory. If the user passed the --keep-failed option and the build eventually fails, the daemon changes ownership of the whole build tree, including the hardlink, to the user. At that point, the user has write access to the target file. Versions after and including v0.11.0-3298-g2608e40988, and versions prior to v1.2.0-75109-g94f0312546 are vulnerable.
insecure temporary file
GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account
CVE-2019-18192
7.8 - High
- October 17, 2019
GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365.
Incorrect Permission Assignment for Critical Resource
