CVE-2021-27851: 
NixOS vulnerability analysis and mitigation

A security vulnerability (CVE-2021-27851) was discovered in 'guix-daemon' that could lead to local privilege escalation. The vulnerability affects multi-user setups where 'guix-daemon' runs locally. It was discovered in March 2021 and affects versions after and including v0.11.0-3298-g2608e40988, and versions prior to v1.2.0-75109-g94f0312546 (GNU Bug Report).

The vulnerability exists in the build process handling of guix-daemon. When a user initiates a build process with the '--keep-failed' option, they can make the build directory world-writable. An attacker can then create a hardlink within the build directory to a root-owned file from outside the build directory (such as '/etc/shadow'). If the build fails, the daemon changes ownership of the entire build tree, including the hardlink, to the user, effectively giving them write access to the target file (GNU Bug Report).

The vulnerability allows local users to gain unauthorized write access to root-owned files, potentially leading to complete system compromise through privilege escalation. The impact is particularly severe in multi-user environments where guix-daemon runs locally (GNU Bug Report).

The vulnerability is exploitable in multi-user setups where guix-daemon runs locally. While initially thought to be mitigated by Linux's 'protected hardlinks' feature, further investigation revealed that exploitation remains possible even with this protection enabled, though more difficult. The vulnerability requires local system access and the ability to execute guix build commands (GNU Bug Report).

The fix involves adding a root-owned 'wrapper' directory containing the build directory and implementing a two-stage move process for failed builds. Users are recommended to upgrade their guix-daemon to commit 94f0312546 or later. On Guix System, this can be done by running 'guix pull' followed by 'guix system reconfigure' and restarting the daemon. For other distributions using systemd, users should run 'sudo --login guix pull' and restart the guix-daemon service (GNU Bug Report).