Medium · 5.7 CVE-2025-59378 EUVD-2025-29155GHSA-75hx-v6j6-m6h7

In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular…

Published Sep 15, 2025 · Updated Sep 15, 2025 · Assigned by mitre

Vendor: GNU Product: Guix Package: guix Package: guix Ecosystem: Debian Ecosystem: Ubuntu

Description

In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular user to gain the privileges of the build user that runs it (even after the build has ended).

Affected products

Vendor	Product	Affected	Fixed
GNU	Guix	—	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 11	guix	No fix yet	—

Ubuntu