From ec912eda760144ea9aadda0dbd64dfd3187270ce Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Mon, 4 May 2026 19:02:20 +0200 Subject: [PATCH] release: release notes for 2.94.2 Release created with releng/create_release.xsh Change-Id: I117f10a79a674d262446555206e4976bb330f491 --- doc/manual/rl-next/unsigned-overflow-vuln.md | 28 ------------------ doc/manual/src/release-notes/rl-2.94.md | 31 ++++++++++++++++++++ 2 files changed, 31 insertions(+), 28 deletions(-) delete mode 100644 doc/manual/rl-next/unsigned-overflow-vuln.md diff --git a/doc/manual/rl-next/unsigned-overflow-vuln.md b/doc/manual/rl-next/unsigned-overflow-vuln.md deleted file mode 100644 index 466ca995c..000000000 --- a/doc/manual/rl-next/unsigned-overflow-vuln.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -synopsis: "Fix unsigned overflow leading to out-of-band write in the NAR parser" -cls: [5553] -category: "Fixes" -credits: [horrors, raito, edef, sandydoo] -issues: [] ---- - -The NAR parser contained an unsigned integer overflow that could be used by an -attacker to write arbitrary data to an unknown memory location and possibly -achieve code execution. A successful attack on the system-wide Lix daemon -could lead to privilege escalation to root. Any process that involves NAR -serialization could trigger this issue, including (but not limited to) - - - local user interaction, whether the users are trusted or untrusted - - malicious substituters sending malformed NARs - - remote builders sending malformed build results - - remote daemons sending malformed inputs when requesting remote builds - -Successful attacks using this bug require ASLR weakening of some sort, whether -by architecture constraints (e.g. on 32 bit systems, where little randomization -is possible) or system configuration (e.g. low ASLR entropy when loading -libraries), and millions of attempts. Local attacks can be mounted in less than -an hour. Remote builds typically require a fresh SSH connection for each build -and are thus less susceptible. Only one attempt can be made by substituters for -every build using substituters, they are thus not a likely vector for attacks. - -At the time of writing, MITRE has not assigned this a CVE yet. diff --git a/doc/manual/src/release-notes/rl-2.94.md b/doc/manual/src/release-notes/rl-2.94.md index 9c62eb8fe..9bd545722 100644 --- a/doc/manual/src/release-notes/rl-2.94.md +++ b/doc/manual/src/release-notes/rl-2.94.md @@ -1,4 +1,35 @@ # Lix 2.94 "Açaí na tigela" (2025-11-17) +# Lix 2.94.2 (2026-05-04) +## Fixes + +- Fix unsigned overflow leading to out-of-band write in the NAR parser [cl/5553](https://gerrit.lix.systems/c/lix/+/5553) + + The NAR parser contained an unsigned integer overflow that could be used by an + attacker to write arbitrary data to an unknown memory location and possibly + achieve code execution. A successful attack on the system-wide Lix daemon + could lead to privilege escalation to root. Any process that involves NAR + serialization could trigger this issue, including (but not limited to) + + - local user interaction, whether the users are trusted or untrusted + - malicious substituters sending malformed NARs + - remote builders sending malformed build results + - remote daemons sending malformed inputs when requesting remote builds + + Successful attacks using this bug require ASLR weakening of some sort, whether + by architecture constraints (e.g. on 32 bit systems, where little randomization + is possible) or system configuration (e.g. low ASLR entropy when loading + libraries), and millions of attempts. Local attacks can be mounted in less than + an hour. Remote builds typically require a fresh SSH connection for each build + and are thus less susceptible. Only one attempt can be made by substituters for + every build using substituters, they are thus not a likely vector for attacks. + + At the time of writing, MITRE has not assigned this a CVE yet. + + Many thanks to [eldritch horrors](https://git.lix.systems/pennae), [Raito Bezarius](https://git.lix.systems/raito), [edef](https://github.com/edef1c), and [sandydoo](https://github.com/sandydoo) for this. + + + + # Lix 2.94.1 (2026-03-13)