CVE-2024-45593
Critical
Description
Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root permissions when using the Nix daemon. This issue is fixed in Nix 2.24.6.
SeverityCritical
CVSS9.0
Exploit probability—
ProductNix
PublishedSep 10, 2024
First seenSep 10, 2024
Weakness typeCWE-22Path traversal
How to fix
Update
- nixos nix2.24.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nixos nix | 2.24.0 ≤ v < 2.24.6 | 2.24.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.