NixOS nix up to 2.3.17/2.18.1/2.19.3/2.20.4 on Linux Unix Domain Socket toctou

Summaryinfo

A vulnerability was found in NixOS nix up to 2.3.17/2.18.1/2.19.3/2.20.4 on Linux. It has been rated as problematic. The impacted element is an unknown function of the component Unix Domain Socket Handler. This manipulation causes toctou. This vulnerability is tracked as CVE-2024-27297. The attack is only possible within the local network. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in NixOS nix up to 2.3.17/2.18.1/2.19.3/2.20.4 on Linux. It has been declared as problematic. Affected by this vulnerability is an unknown function of the component Unix Domain Socket Handler. The manipulation with an unknown input leads to a toctou vulnerability. The CWE definition for the vulnerability is CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. As an impact it is known to affect integrity, and availability. The summary by CVE is:

Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as "valid" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The weakness was disclosed 03/12/2024 as GHSA-2ffj-w4mj-pg37. The advisory is shared at github.com. This vulnerability is known as CVE-2024-27297 since 02/22/2024. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 242201 (Ubuntu 22.04 LTS / 24.04 LTS : Nix vulnerabilities (USN-7633-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability. Applying the patch f8170ce9f119e5e6724eb81ff1b5a2d4c0024000 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (242201). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• NixOS

Name

• nix

Version

• 2.3.0
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5
• 2.3.6
• 2.3.7
• 2.3.8
• 2.3.9
• 2.3.10
• 2.3.11
• 2.3.12
• 2.3.13
• 2.3.14
• 2.3.15
• 2.3.16
• 2.3.17
• 2.18.0
• 2.18.1
• 2.19.0
• 2.19.1
• 2.19.2
• 2.19.3
• 2.20.0
• 2.20.1
• 2.20.2
• 2.20.3
• 2.20.4

License

• open-source

Website

• Product: https://github.com/NixOS/nix/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion