CVE-2019-18192
📋 TL;DR
CVE-2019-18192 is a privilege escalation vulnerability in GNU Guix where the parent directory of user-profile directories is world-writable, allowing local users to access and potentially compromise other users' accounts. This affects GNU Guix installations where multiple users share the same system. The vulnerability is similar to CVE-2019-17365 and requires local access to exploit.
💻 Affected Systems
- GNU Guix
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full control over another user's account, potentially accessing sensitive data, modifying configurations, or escalating to root privileges through the compromised account.
Likely Case
Local user accesses another user's profile directory, potentially reading sensitive configuration files or modifying user environments.
If Mitigated
With proper directory permissions and user isolation, impact is limited to unauthorized directory access without privilege escalation.
🎯 Exploit Status
Exploitation requires local user access and basic knowledge of directory traversal. The vulnerability is well-documented in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in GNU Guix 1.1.0 and later
Vendor Advisory: https://issues.guix.gnu.org/issue/37744
Restart Required: No
Instructions:
1. Update GNU Guix to version 1.1.0 or later using 'guix pull' 2. Run 'guix package --upgrade' to update installed packages 3. Verify directory permissions are corrected
🔧 Temporary Workarounds
Manual Permission Fix
linuxManually change permissions on the parent directory of user profiles to remove world-writable access
sudo chmod o-w /var/guix/profiles/per-user
🧯 If You Can't Patch
- Implement strict user isolation and limit local user access to the system
- Monitor file system changes in the /var/guix/profiles/per-user directory for unauthorized access
🔍 How to Verify
Check if Vulnerable:
Check if /var/guix/profiles/per-user directory is world-writable: 'ls -ld /var/guix/profiles/per-user' - if output shows 'drwxrwxrwx' or similar with 'w' for others, system is vulnerableCheck Version:
guix --versionVerify Fix Applied:
Verify directory permissions: 'ls -ld /var/guix/profiles/per-user' should NOT show 'w' permission for others (world)📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /var/guix/profiles/per-user directories
- Permission changes on Guix profile directories
Network Indicators:
- No network indicators - this is a local file system vulnerability
SIEM Query:
file_access AND path:"/var/guix/profiles/per-user/*" AND NOT user:root