From 89999119dc2452fbb1e04f80e8b2b9cd4bc0dbc7 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Mon, 4 May 2026 18:43:36 +0200 Subject: [PATCH] release: release notes for 2.95.2 Release created with releng/create_release.xsh Change-Id: I8f7770c1a04ccac61a5c40d2453af28ad2810594 --- doc/manual/rl-next/unsigned-overflow-vuln.md | 28 ------------------ doc/manual/src/release-notes/rl-2.95.md | 31 ++++++++++++++++++++ 2 files changed, 31 insertions(+), 28 deletions(-) delete mode 100644 doc/manual/rl-next/unsigned-overflow-vuln.md diff --git a/doc/manual/rl-next/unsigned-overflow-vuln.md b/doc/manual/rl-next/unsigned-overflow-vuln.md deleted file mode 100644 index 43b4f4cac..000000000 --- a/doc/manual/rl-next/unsigned-overflow-vuln.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -synopsis: "Fix unsigned overflow leading to out-of-band write in the NAR parser" -cls: [5550] -category: "Fixes" -credits: [horrors, raito, edef, sandydoo] -issues: [] ---- - -The NAR parser contained an unsigned integer overflow that could be used by an -attacker to write arbitrary data to an unknown memory location and possibly -achieve code execution. A successful attack on the system-wide Lix daemon -could lead to privilege escalation to root. Any process that involves NAR -serialization could trigger this issue, including (but not limited to) - - - local user interaction, whether the users are trusted or untrusted - - malicious substituters sending malformed NARs - - remote builders sending malformed build results - - remote daemons sending malformed inputs when requesting remote builds - -Successful attacks using this bug require ASLR weakening of some sort, whether -by architecture constraints (e.g. on 32 bit systems, where little randomization -is possible) or system configuration (e.g. low ASLR entropy when loading -libraries), and millions of attempts. Local attacks can be mounted in less than -an hour. Remote builds typically require a fresh SSH connection for each build -and are thus less susceptible. Only one attempt can be made by substituters for -every build using substituters, they are thus not a likely vector for attacks. - -At the time of writing, MITRE has not assigned this a CVE yet. diff --git a/doc/manual/src/release-notes/rl-2.95.md b/doc/manual/src/release-notes/rl-2.95.md index 22c4a0780..b01dab977 100644 --- a/doc/manual/src/release-notes/rl-2.95.md +++ b/doc/manual/src/release-notes/rl-2.95.md @@ -1,4 +1,35 @@ # Lix 2.95 "Kakigōri" (2026-03-13) +# Lix 2.95.2 (2026-05-04) +## Fixes + +- Fix unsigned overflow leading to out-of-band write in the NAR parser [cl/5550](https://gerrit.lix.systems/c/lix/+/5550) + + The NAR parser contained an unsigned integer overflow that could be used by an + attacker to write arbitrary data to an unknown memory location and possibly + achieve code execution. A successful attack on the system-wide Lix daemon + could lead to privilege escalation to root. Any process that involves NAR + serialization could trigger this issue, including (but not limited to) + + - local user interaction, whether the users are trusted or untrusted + - malicious substituters sending malformed NARs + - remote builders sending malformed build results + - remote daemons sending malformed inputs when requesting remote builds + + Successful attacks using this bug require ASLR weakening of some sort, whether + by architecture constraints (e.g. on 32 bit systems, where little randomization + is possible) or system configuration (e.g. low ASLR entropy when loading + libraries), and millions of attempts. Local attacks can be mounted in less than + an hour. Remote builds typically require a fresh SSH connection for each build + and are thus less susceptible. Only one attempt can be made by substituters for + every build using substituters, they are thus not a likely vector for attacks. + + At the time of writing, MITRE has not assigned this a CVE yet. + + Many thanks to [eldritch horrors](https://git.lix.systems/pennae), [Raito Bezarius](https://git.lix.systems/raito), [edef](https://github.com/edef1c), and [sandydoo](https://github.com/sandydoo) for this. + + + + # Lix 2.95.1 (2026-03-19) ## Fixes