Nixpkgs security tracker
6.3 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
Electron: Parent process code-sign check is spoofable
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents rely on this check, and a local attacker could bypass it and run code inside the signed app, inheriting its TCC permissions and keychain access. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
References
Affected products
- ==< 39.8.8
- ==>= 42.0.0-alpha.1, < 42.0.0-beta.3
- ==>= 41.0.0-alpha.1, < 41.2.1
- ==>= 40.0.0-alpha.1, < 40.9.0
Matching in nixpkgs
pkgs.electron
Cross platform desktop application shell
pkgs.electron_38
None
pkgs.electron_39
Cross platform desktop application shell
pkgs.electron_40
Cross platform desktop application shell
pkgs.electron_41
Cross platform desktop application shell
pkgs.electron_42
Cross platform desktop application shell
pkgs.electron_43
Cross platform desktop application shell
pkgs.electron-bin
Cross platform desktop application shell
pkgs.electron-cash
Bitcoin Cash SPV Wallet
pkgs.electron-mail
Unofficial Election-based ProtonMail desktop client
pkgs.electron-fiddle
Easiest way to get started with Electron
pkgs.electron_38-bin
None
pkgs.electron_39-bin
Cross platform desktop application shell
pkgs.electron_40-bin
Cross platform desktop application shell
pkgs.electron_41-bin
Cross platform desktop application shell
pkgs.electron_42-bin
Cross platform desktop application shell
pkgs.electron_43-bin
Cross platform desktop application shell
pkgs.todoist-electron
To-Do List App & Task Manager
pkgs.jitsi-meet-electron
Jitsi Meet desktop application powered by Electron
pkgs.electron-chromedriver
WebDriver server for running Selenium tests on Chrome
pkgs.idrisPackages.electron
Electron bindings for Idris
-
nixos-unstable 2016-03-07
- nixpkgs-unstable 2016-03-07
- nixos-unstable-small 2016-03-07
-
nixos-26.05 2016-03-07
- nixos-26.05-small 2016-03-07
- nixpkgs-26.05-darwin 2016-03-07
pkgs.electron-chromedriver_38
None
pkgs.electron-chromedriver_39
WebDriver server for running Selenium tests on Chrome
pkgs.electron-chromedriver_40
WebDriver server for running Selenium tests on Chrome
pkgs.electron-chromedriver_41
WebDriver server for running Selenium tests on Chrome
pkgs.electron-chromedriver_42
WebDriver server for running Selenium tests on Chrome
pkgs.electron-chromedriver_43
WebDriver server for running Selenium tests on Chrome
Package maintainers
-
@yayayayaka Yaya <github@uwu.is>
-
@teutat3s teutat3s <teutates@mailbox.org>
-
@TomaSajt TomaSajt
-
@oxalica oxalica <oxalicc@pm.me>
-
@nyanloutre Paul Trehiou <paul@nyanlout.re>
-
@liam-murphy14 Liam Murphy <liam.murphy137@gmail.com>
-
@andersk Anders Kaseorg <andersk@mit.edu>
-
@BatteredBunny BatteredBunny <ayes2022@protonmail.com>
-
@Princemachiavelli Josh Hoffer <jhoffer@sansorgan.es>
-
@brainrake Marton Boros <martonboros@gmail.com>
-
@Lassulus Lassulus <lassulus@gmail.com>
-
@novmar Marcel Novotny <novotny@marnov.cz>
-
@ryantm Ryan Mulligan <ryan@ryantm.com>
-
@kylesferrazza Kyle Sferrazza <nixpkgs@kylesferrazza.com>
-
@pokon548 Bu Kun <nix@bukn.uk>