Security Advisory: Privilege Escalations in Nix, Lix and Guix

[RaitoBezarius]

@tobiasBora

Question: if my understanding is correct, this attack is NOT related to any kind of kernel bug. But if my memory is correct, linux’s kernel have/had some bugs allowing to escape from a a sandbox, like docker. Are these bugs still around, and if so does it mean that it is anyway unsafe to build untrusted derivations?

No, to the best of our knowledge.

@tobiasBora

Remark about similarly dangerous unfixed attack: more than one year ago, after emailing nix’s security team, I submitted this CVE and discussed it in re-fetch source when url changes · Issue #969 · NixOS/nix · GitHub and Provide a binary cache for builds · Issue #68 · NixOS/ofborg · GitHub. This describes an attack that is almost impossible to detect (for a PR reviewer) allowing a malicious PR to inject arbitrarily malicious code in basically any software, by simply changing the hash. The attack is very easy to run and can have devastating effects (trapdoor, viruses…). Yet, as far as I know, one year later, it is still effective, even if I proposed some proposals for potential fixes (the best fixes are not completely trivial as they require nix & caches to also maintain a list of verified couple hash/url, but as far as I see this is the only really robust solution to this issue). Is there any update on this?

Yes, see fod-oracle.org and Transforming global software distribution with Nixpkgs.
But this is offtopic, please, so open a new thread if you want to discuss this further.