CVE-2020-25031: 
NixOS vulnerability analysis and mitigation

Checkinstall 1.6.2 contains a vulnerability that affects package creation when handling symlinks. The vulnerability was discovered and disclosed on August 31, 2020. When creating a package containing a symlink, the software may incorrectly set file permissions, resulting in the creation of a mode 0777 (world-writable) executable file (NVD, Ubuntu Security).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High), with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The issue is classified as CWE-59: Improper Link Resolution Before File Access ('Link Following'). The vulnerability specifically manifests when checkinstall is used to create packages containing symbolic links, where the file permission handling mechanism fails to properly preserve the original file permissions (NVD).

The vulnerability can lead to the creation of world-writable executable files (mode 0777), which could allow any user to modify the contents of the affected files. This could potentially enable local privilege escalation if a root user executes the modified binary, leading to arbitrary code execution with elevated privileges (Launchpad Bug).

The vulnerability requires local access and can be exploited when creating packages containing symlinks. A proof-of-concept exploit has been documented that demonstrates how an attacker could create a package that, when installed, results in world-writable executables that can be modified by any user on the system (Launchpad Bug).

As of the latest reports, the vulnerability remains unfixed in multiple distributions including Debian Bullseye, Bookworm, and Sid. The original upstream project appears to be inactive, with no official fix available. The Debian maintainer has acknowledged the issue and indicated work would be done to address the security concerns (Debian Security).