CVE-2025-32438: Local privilege escalation in make-initrd-ng
First published: Tue Apr 15 2025(Updated: )
make-initrd-ng is a tool for copying binaries and their dependencies. Local privilege escalation affecting all NixOS users. With systemd.shutdownRamfs.enable enabled (the default) a local user is able to create a program that will be executed by root during shutdown. Patches exist for NixOS 24.11 and 25.05 / unstable. As a workaround, set systemd.shutdownRamfs.enable = false;.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| NixOS make-initrd-ng | <24.11>=24.11<=25.05 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-32438?
CVE-2025-32438 has been identified as a local privilege escalation vulnerability affecting all NixOS users.
How can I mitigate CVE-2025-32438?
To mitigate CVE-2025-32438, ensure that the systemd.shutdownRamfs.enable option is disabled or apply the patches provided by NixOS.
Which versions of NixOS make-initrd-ng are affected by CVE-2025-32438?
CVE-2025-32438 affects NixOS make-initrd-ng versions from 24.11 up to but not including 25.05.
Who is affected by CVE-2025-32438?
All users of NixOS who have the make-initrd-ng utility and the default setting for systemd.shutdownRamfs.enable are affected by CVE-2025-32438.
Can I report my findings regarding CVE-2025-32438?
Yes, users can report their findings or any issues related to CVE-2025-32438 to the NixOS security team through their designated channels.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/author
- agent/severity
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/nixos
- canonical/nixos make-initrd-ng