Nix Bug Allows for Arbitrary File System Write with Root Privileges

CVE-2024-45593

What is CVE-2024-45593?

A vulnerability exists in the Nix package manager, which is utilized in Linux and Unix systems. Specifically, users of Nix versions prior to 2.24.6 may be susceptible to an issue where a malicious user or substituter can craft a NAR file. When unpacked by the Nix process, this NAR can result in writes to arbitrary file system locations, leveraging the permissions that the Nix process possesses. Notably, if the Nix daemon is in use, this could lead to operations executed with root permissions, heightening the risk of significant system impacts.

References