CVE-2017-1000455

MEDIUM

GuixSD < 0.13.0 - Origin Validation Error via Incorrect POSIX Hard Link Usage

Title source: llm
STIX 2.1

Description

GuixSD prior to Git commit 5e66574a128937e7f2fcf146d146225703ccfd5d used POSIX hard links incorrectly, leading the creation of setuid executables in "the store", violating a fundamental security assumption of GNU Guix.

References (1)

Core 1
Core References
Issue Tracking, Patch, Vendor Advisory x_refsource_misc
https://lists.gnu.org/archive/html/guix-devel/2017-10/msg00090.html

Scores

CVSS v3 5.5
EPSS 0.0002
EPSS Percentile 6.4%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-346
Status published
Products (1)
gnu/guixsd < 0.13.0
Published Jan 02, 2018
Tracked Since Feb 18, 2026