Insecure Permissions in GNU Guile mkdir Procedure
Summary
CVE-2016-8605: The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. Affects guile versions < 2.0.11-r3. Fixed in 2.0.11-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Guile is a programming language and an interpreter for Scheme, a dialect of the Lisp programming language. It provides a wide range of features and libraries for developing and executing Scheme programs. The mkdir procedure in GNU Guile is responsible for creating directories. However, prior to version 2.0.13, there was a vulnerability in this procedure that temporarily changed the process' umask to zero. This allowed other threads in a multithreaded application to create directories with insecure permissions, potentially leading to unauthorized access or data leakage.
Vulnerability Detail
The vulnerability, identified as CVE-2016-8605, arises from the temporary change in the process' umask to zero during the mkdir procedure in GNU Guile. In a multithreaded application, this can result in the creation of directories with insecure permissions. For example, if the optional mode argument is not provided, directories would be created with permissions set to 0777, allowing anyone to read, write, and execute them. This vulnerability can be exploited by an attacker to gain unauthorized access to sensitive data or execute arbitrary code.
How To Fix
Minimum fixed version
2.0.11-r3
This is the first release that contains the fix.
sudo apk add --upgrade guileTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually set the desired permissions when using the mkdir procedure in GNU Guile. By explicitly specifying the mode argument with appropriate permissions, such as 0755 for read and execute access to the owner and read access to others, the creation of directories with insecure permissions can be avoided. Here is an example of how to use mkdir with the mode argument in GNU Guile:
(use-modules (ice-9 rdelim))
(mkdir "/path/to/directory" #o755)
By setting the mode to #o755, the directory will be created with permissions 0755.
Conclusion
Insecure permissions in the mkdir procedure of GNU Guile can lead to the creation of directories with wide-ranging access permissions, potentially compromising the security of sensitive data. It is crucial to update GNU Guile to version 2.0.13 or later to mitigate this vulnerability. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for guile →
FAQ
GNU Guile is a programming language and an interpreter for Scheme, a dialect of the Lisp programming language. It provides a wide range of features and libraries for developing and executing Scheme programs.
The mkdir procedure in GNU Guile is used to create directories.
The CVE-2016-8605 vulnerability in GNU Guile can result in the creation of directories with insecure permissions, potentially allowing unauthorized access to sensitive data or execution of arbitrary code.
To fix the vulnerability, it is recommended to update GNU Guile to version 2.0.13 or later, which includes the necessary patches to address the insecure permissions issue.
Yes, users can manually set the desired permissions when using the mkdir procedure in GNU Guile by explicitly specifying the mode argument with appropriate permissions.
Related vulnerabilities
Recent vulnerabilities recorded for guile.
