CVE-2024-45593: Nix affected by unsafe NAR unpacking
Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root permissions when using the Nix daemon. This issue is fixed in Nix 2.24.6.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45593?
CVE-2024-45593 has a high severity due to its potential for arbitrary file system writes by malicious users.
How do I fix CVE-2024-45593?
To fix CVE-2024-45593, upgrade Nix to version 2.24.6 or later.
What systems are affected by CVE-2024-45593?
CVE-2024-45593 affects Nix versions from 2.24.0 up to 2.24.5.
What exploitation methods are possible with CVE-2024-45593?
An attacker can exploit CVE-2024-45593 by crafting a malicious NAR file that Nix will unpack to write to arbitrary file system locations.
What is the impact of CVE-2024-45593?
The impact of CVE-2024-45593 includes unauthorized access and potential modification of files on the file system.