🛡️ CVE-2021-45707 — nix

Out-of-bounds write in nix::unistd::getgrouplist

On certain platforms, if a user has more than 16 groups, the

nix::unistd::getgrouplist function will call the libc getgrouplist

function with a length parameter greater than the size of the buffer it

provides, resulting in an out-of-bounds write and memory corruption.

The libc getgrouplist function takes an in/out parameter ngroups

specifying the size of the group buffer. When the buffer is too small to

hold all of the requested user's group memberships, some libc

implementations, including glibc and Solaris libc, will modify ngroups

to indicate the actual number of groups for the user, in addition to

returning an error. The version of nix::unistd::getgrouplist in nix

0.16.0 and up will resize the buffer to twice its size, but will not

read or modify the ngroups variable. Thus, if the user has more than

twice as many groups as the initial buffer size of 8, the next call to

getgrouplist will then write past the end of the buffer.

The issue would require editing /etc/groups to exploit, which is usually

only editable by the root user.