CVE-2024-27297: Nix Corruption of fixed-output derivations

Published Mar 11, 2024
·
Updated

Last updated 16 September 2026

Other sources

Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as "valid" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

— MITRE

Affected Software

7 affected componentsFixes available
Nix Nix>=2.3.18<2.20.5
NixOS Nix<2.3.18
NixOS Nix>=2.4<2.18.2
NixOS Nix>=2.19.0<2.19.4
NixOS Nix>=2.20.0<2.20.5
debian/guix
1.4.0-9
debian/nix<=2.8.0-1.1
2.26.3+dfsg-12.34.8+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/guix to a version that resolves this vulnerability.

    Fixed in 1.4.0-9
  2. Upgrade

    Upgrade debian/nix to a version that resolves this vulnerability.

    Fixed in 2.26.3+dfsg-1Fixed in 2.34.8+dfsg-1
  3. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.3.18
  4. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.18.2
  5. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.19.4
  6. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.20.5

Event History

Mar 11, 2024
CVE Published
via MITRE·09:24 PM
Data Sourced
via MITRE·09:24 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Sep 16, 2026
Data Sourced
via Launchpad·02:32 PM
Description
Data Sourced
via Debian·02:32 PM
DescriptionAffected Software
Sep 17, 2026
Data Sourced
via Ubuntu·02:31 PM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2024-27297?

CVE-2024-27297 has been classified as a high severity vulnerability due to the potential for unauthorized file descriptor access.

2

How do I fix CVE-2024-27297?

To fix CVE-2024-27297, update your Nix package manager to a version above 2.20.5.

3

What versions of Nix are affected by CVE-2024-27297?

CVE-2024-27297 affects Nix versions from 2.3.18 to 2.20.5.

4

What is the impact of CVE-2024-27297?

The impact of CVE-2024-27297 includes potential exposure of file descriptors leading to data leakage or unauthorized operations.

5

Who is vulnerable to CVE-2024-27297?

Any system running an affected version of the Nix package manager on Linux or Unix-like operating systems is vulnerable to CVE-2024-27297.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203