NixOS Nix up to 2.24.15/2.26.4/2.28.4/2.29.1 improper ownership management

Summaryinfo

A vulnerability was found in NixOS Nix up to 2.24.15/2.26.4/2.28.4/2.29.1. It has been classified as problematic. Impacted is an unknown function. The manipulation leads to improper ownership management. This vulnerability is referenced as CVE-2025-46416. The attack can only be performed from a local environment. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in NixOS Nix up to 2.24.15/2.26.4/2.28.4/2.29.1. This issue affects an unknown code block. The manipulation with an unknown input leads to a improper ownership management vulnerability. Using CWE to declare the problem leads to CWE-282. The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource. Impacted is integrity. The summary by CVE is:

The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild). This affects Nix through 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix through 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.

The advisory is shared at discourse.nixos.org. The identification of this vulnerability is CVE-2025-46416 since 04/24/2025. The exploitation is known to be difficult. An attack has to be approached locally. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 259387 (Linux Distros Unpatched Vulnerability : CVE-2025-46416), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (259387) and EUVD (EUVD-2025-19410). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• NixOS

Name

• Nix

Version

• 2.24.0
• 2.24.1
• 2.24.2
• 2.24.3
• 2.24.4
• 2.24.5
• 2.24.6
• 2.24.7
• 2.24.8
• 2.24.9
• 2.24.10
• 2.24.11
• 2.24.12
• 2.24.13
• 2.24.14
• 2.24.15
• 2.26.0
• 2.26.1
• 2.26.2
• 2.26.3
• 2.26.4
• 2.28.0
• 2.28.1
• 2.28.2
• 2.28.3
• 2.28.4
• 2.29.0
• 2.29.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion