Nix
Monthly
Local privilege escalation in Nix package manager daemon (versions prior to 2.34.5/2.33.4/2.32.7/2.31.4/2.30.4/2.29.3/2.28.6) allows unprivileged users to gain root access in multi-user Linux installations. Incomplete fix for CVE-2024-27297 permits symlink attacks during fixed-output derivation registration, enabling arbitrary file overwrites as root. Attackers exploit sandboxed build registration by placing symlinks in temporary output paths, causing the daemon to follow symlinks and overwrite sensitive system files with controlled content. Affects default configurations where all users can submit builds. No public exploit identified at time of analysis.
Sandbox escape in Nix versions before 2.35.0 allows a malicious build derivation - executed under the experimental `recursive-nix` feature - to create or truncate empty files outside the build sandbox using the nix-daemon's permissions by exploiting a TOCTOU race in the LocalStore path-restore logic. The race window exists between path resolution and the `open()` call with `O_TRUNC` in `writeFile`, which previously lacked `O_NOFOLLOW` enforcement, letting an attacker substitute a symlink mid-flight to redirect the write. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the official fix is confirmed in Nix 2.35.0.
Nix is a package manager for Linux and other Unix systems. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Local privilege escalation in Nix package manager daemon (versions prior to 2.34.5/2.33.4/2.32.7/2.31.4/2.30.4/2.29.3/2.28.6) allows unprivileged users to gain root access in multi-user Linux installations. Incomplete fix for CVE-2024-27297 permits symlink attacks during fixed-output derivation registration, enabling arbitrary file overwrites as root. Attackers exploit sandboxed build registration by placing symlinks in temporary output paths, causing the daemon to follow symlinks and overwrite sensitive system files with controlled content. Affects default configurations where all users can submit builds. No public exploit identified at time of analysis.
Sandbox escape in Nix versions before 2.35.0 allows a malicious build derivation - executed under the experimental `recursive-nix` feature - to create or truncate empty files outside the build sandbox using the nix-daemon's permissions by exploiting a TOCTOU race in the LocalStore path-restore logic. The race window exists between path resolution and the `open()` call with `O_TRUNC` in `writeFile`, which previously lacked `O_NOFOLLOW` enforcement, letting an attacker substitute a symlink mid-flight to redirect the write. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the official fix is confirmed in Nix 2.35.0.
Nix is a package manager for Linux and other Unix systems. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.