SB2026050485 - Multiple vulnerabilities in nix

Description

This security bulletin contains information about 2 vulnerabilities.

1) Absolute Path Traversal (CVE-ID: N/A)

CWE-ID: CWE-36 - Absolute Path Traversal

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to modify files outside the intended extraction directory.

The vulnerability exists due to absolute path traversal in the archive unpacking functionality of nix-prefetch-url --unpack, nix store prefetch-file --unpack, and builtin:unpack-channel when processing archives containing entries with absolute paths. A remote attacker can supply a specially crafted archive to modify files outside the intended extraction directory.

User interaction is required to unpack an untrusted archive. The builtin:unpack-channel builder is sandboxed in sandboxed builds.

2) Uncontrolled Recursion (CVE-ID: N/A)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to uncontrolled recursion in the NAR directory parser when parsing a crafted NAR archive on a coroutine stack. A local user can supply a specially crafted NAR archive to execute arbitrary code.

Exploitation is possible for users able to connect to the Nix daemon, and successful exploitation may run code as the Nix daemon in multi-user installations if ASLR hardening is bypassed.

Remediation

Install update from vendor's website.

References

• https://github.com/NixOS/nix/security/advisories/GHSA-gr92-w2r5-qw5p
• https://github.com/NixOS/nix/security/advisories/GHSA-vh5x-56v6-4368
• https://github.com/NixOS/nix/pull/11152