Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2025-59378 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular user to gain the privileges of the build user that runs it (even after the build has ended).

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:7.1 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CNA: [email protected]CVSS-B:5.7 MEDIUMVector:CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://codeberg.org/guix/guix/commit/1618ca7aa2ee8b6519ee9fd0b965e15eca2bfe45	[email protected]	Source CodeVendor
https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerability-2025-2/	[email protected]	AdvisoryExploitRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-669	Incorrect Resource Transfer Between Spheres	[email protected]

Affected Products

Product	Versions
GNU Guix	< 1618ca7
CPE cpe:2.3:a:gnu:guix:::::::: Remediation Upgrade: 1618ca7moderate effort For Guix System, reconfigure the system after a `guix pull`, either restarting `guix-daemon` or rebooting. For example: ``` guix pull sudo guix system reconfigure /run/current-system/configuration.scm sudo herd restart guix-daemon ``` For Guix on another distribution, run `guix pull` with `sudo`, as the `guix-daemon` runs as root, and restart the `guix-daemon` service. For example, on a system using systemd to manage services, run: ``` sudo --login guix pull sudo systemctl restart guix-daemon.service ``` Note that for users with their distro's package of Guix (as opposed to having used the install script) you may need to take other steps or upgrade the Guix package as per other packages on your distro. Please consult the relevant documentation from your distro or contact the package maintainer for additional information or questions.

Product

Versions

GNU Guix

< 1618ca7

CPE

cpe:2.3:a:gnu:guix:*:*:*:*:*:*:*:*

Remediation

Upgrade: 1618ca7moderate effort
For Guix System, reconfigure the system after a `guix pull`, either restarting `guix-daemon` or rebooting. For example: ``` guix pull sudo guix system reconfigure /run/current-system/configuration.scm sudo herd restart guix-daemon ``` For Guix on another distribution, run `guix pull` with `sudo`, as the `guix-daemon` runs as root, and restart the `guix-daemon` service. For example, on a system using systemd to manage services, run: ``` sudo --login guix pull sudo systemctl restart guix-daemon.service ``` Note that for users with their distro's package of Guix (as opposed to having used the install script) you may need to take other steps or upgrade the Guix package as per other packages on your distro. Please consult the relevant documentation from your distro or contact the package maintainer for additional information or questions.

Change History

3 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Sep 15, 2025	New CVE Received	[email protected]