SB2024030783 - Improper access control in nix

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2024-27297)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to modify the output of fixed-output derivations.

The vulnerability exists due to improper access control in fixed-output derivations when sending file descriptors to files in the Nix store to another program via Unix domain sockets in the abstract namespace. A remote user can send file descriptors to another program running on the host to modify the output of fixed-output derivations.

This issue affects Linux systems and can occur after Nix has registered the path as valid and immutable in the Nix database.

Remediation

Install update from vendor's website.

References

• https://github.com/NixOS/nix/security/advisories/GHSA-2ffj-w4mj-pg37
• https://github.com/advisories/GHSA-2ffj-w4mj-pg37