Improper access control in nix - CVE-2024-27297
Published: March 7, 2024 / Updated: April 8, 2026
Vulnerability identifier: #VU125377
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-27297
CWE-ID: CWE-284
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify the output of fixed-output derivations.
The vulnerability exists due to improper access control in fixed-output derivations when sending file descriptors to files in the Nix store to another program via Unix domain sockets in the abstract namespace. A remote user can send file descriptors to another program running on the host to modify the output of fixed-output derivations.
This issue affects Linux systems and can occur after Nix has registered the path as valid and immutable in the Nix database.
Affected software
nix
Debian Linux
Ubuntu
guix (Debian package)
nix (Ubuntu package)
Debian Linux
Ubuntu
guix (Debian package)
nix (Ubuntu package)
How to mitigate CVE-2024-27297
Install security update from vendor's website.
nix - addressed in versions 2.3.18, 2.18.2, 2.19.4, 2.20.5
guix (Debian package) - addressed in versions 1.2.0-4+deb11u2, 1.4.0-3+deb12u1
nix (Ubuntu package) - addressed in versions 2.6.0+dfsg-3ubuntu0.1~esm1, 2.18.1+dfsg-1ubuntu5+esm2
guix (Debian package) - addressed in versions 1.2.0-4+deb11u2, 1.4.0-3+deb12u1
nix (Ubuntu package) - addressed in versions 2.6.0+dfsg-3ubuntu0.1~esm1, 2.18.1+dfsg-1ubuntu5+esm2