CVE-2024-52867

What it actually does

guix-daemon exposes build outputs to local users before setuid and setgid metadata is applied, enabling unauthorized access to privileged binaries.

Why it matters to the business

Local attackers can obtain root-level access on affected systems, leading to full host compromise, data theft, or persistence that disrupts operations until the daemon is updated and restarted.

How an attack unfolds

An attacker on a multi-user system waits for or triggers a package build, then accesses the incomplete build directory containing setuid/setgid programs before the daemon corrects their ownership and permissions, allowing execution with elevated privileges.

How to fix it

Upgrade GNU Guix to include both commits 5ab3c4c and 558224140dab669cabdaebabff18504a066c48d4, then run guix pull, reconfigure the system, and restart guix-daemon.

How to confirm the fix worked

Confirm the running guix-daemon version incorporates both required commits, verify build directories are no longer world-accessible during builds, and test that setuid/setgid programs receive correct metadata before becoming available.

Typical attack path

1. Obtain local unprivileged access to a system running guix-daemon
2. Trigger or monitor a package build process
3. Access the build output directory before metadata fixes are applied
4. Execute the resulting setuid or setgid binary to escalate privileges

How to detect it

Review guix-daemon logs for build output paths created with permissive permissions, audit for unexpected setuid or setgid files appearing in /gnu/store or temporary build directories, and correlate with local user activity during package builds.

What your security team should do

• Immediately perform guix pull followed by system reconfigure and daemon restart on all Guix installations
• Restrict local user access to build directories until patched
• Monitor for unexpected setuid binaries appearing in user-accessible paths