Vulnerability · Published Jun 28, 2024 · Assigned by GitHub_M

CVE-2024-38531Nix sandbox escape

Low 3.6

In plain English

A low-severity security flaw in nix from NixOS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.6Low

Exploit odds (30 days)0.1%top 96.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change the permissions of the build directory. After creating a setuid binary in a globally accessible location, a malicious local user can assume the permissions of a Nix daemon worker and hijack all future builds. This issue was patched in version(s) 2.23.1, 2.22.2, 2.21.3, 2.20.7, 2.19.5 and 2.18.4.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	nix	no fix listed	DEBIAN-CVE-2024-38531
Debian:13	nix	2.23.3+dfsg-1	DEBIAN-CVE-2024-38531
Debian:14	nix	2.23.3+dfsg-1	DEBIAN-CVE-2024-38531

Affected products (as reported)

Vendor	Product	Versions
NixOS	nix	>= 2.23.0, < 2.23.1>= 2.22.0, < 2.22.2>= 2.21.0, < 2.21.3>= 2.20.0, < 2.20.7>= 2.19.0, < 2.19.5>= 2.18.0, < 2.18.4

Weakness: CWE-278 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

References

https://github.com/NixOS/nix/security/advisories/GHSA-q82p-44mg-mgh5 x_refsource_CONFIRM
https://github.com/NixOS/nix/pull/10501 x_refsource_MISC