See how nixos compares to other vendors in security performance
Hello everyone,
The Lix issue has been assigned CVE-2026-44028 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N). The Lix team has published a detailed blog post about it here for those of you wanting extra details: https://lix.systems/blog/2026-05-05-lix-unsigned-integer-overflow/
We are currently having some troubles getting this CVE split from the Nix issue GHSA-vh5x-56v6-4368 and updated accordingly. While both vulnerabilities could lead to similar compromises and were discovered around the same time, they do not share the same root cause.
The other Nix vulnerability, GHSA-gr92-w2r5-qw5p, has been assigned CVE-2026-44029.
Le lun. 4 mai 2026 à 23:06, Thomas GERBET <thomas () gerbet me> a écrit : Summary
Nix and Lix daemon implementations are affected by buffer overflows vulnerabilities that allow a local attacker to gain arbitrary code execution as the daemon user (root in multi-user installations).
The vulnerabilities are identified as: - Nix: GHSA-vh5x-56v6-4368, CVE ID pending attribution. - Lix: CVE ID pending attribution.
This is a coordinated disclosure between the Nix and Lix projects.
Guix is NOT affected by this vulnerability.
Am I affected?
To exploit this issue, a local attacker needs access to talk to the Nix daemon. All systems that allow connections to their daemons are affected. Only users that are allowed to connect to the daemon (via allowed-users and trusted-users) can reliably trigger the issue. Substituters can in theory trigger the issue but cannot make enough attempts to mount attacks in practice.
Additionally, this vulnerability requires ASLR weakening techniques to lead to a compromise.
Fixes
The vulnerabilities are fixed in the following versions:
- Nix: - Affected versions: ≥ 2.24.4 - Fixed versions: 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, 2.28.7
Nix security release also includes patches that address an unrelated path traversal vulnerability GHSA-gr92-w2r5-qw5p (CVE ID pending attribution).
- Lix: - Affected versions: ≥ 2.93.0 - Fixed versions: 2.93.4, 2.94.2, 2.95.2
Acknowledgement
- We would like to thank @edef with the help of Sander (@sandydoo) for reporting the issues and working with the development teams to suggest and confirm the fixes. - Thanks to eldritch horrors (@pennae) and Raito Bezarius (@RaitoBezarius) on the Lix side for the mitigation. - Thanks to @xokdvium on the Nix side for the mitigation. - Thanks to @hexa and @tgerbet on the NixOS security team for coordinating this.
References
https://discourse.nixos.org/t/security-advisory-local-privilege-escalation-in-lix-and-nix/77407 Nix issues: - https://github.com/NixOS/nix/security/advisories/GHSA-vh5x-56v6-4368 - https://github.com/NixOS/nix/security/advisories/GHSA-gr92-w2r5-qw5p Lix in-depth review blog post: not yet published
crypto: algifaead - Revert to operating out-of-place
Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation's output contents. In multi-user installations, this allows all users able to submit builds to the Nix daemon (allowed-users - defaulting to all users) to gain root privileges by modifying sensitive files. This vulnerability is fixed in 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6.
End of life: 7/13/2026, Latest version: 2.34.8
End of life: 2/27/2026, Latest version: 2.33.6
End of life: 6/30/2026
NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to before 25.05 and versions before Unstable 25.11, a hard-coded secret was used in the NixOS module for the OnlyOffice document server to protect its file cache. An attacker with knowledge of an existing revision ID could use this secret to obtain a document. In practice, an arbitrary revision ID should be hard to obtain. The primary impact is likely the access to known documents from users with expired access. This issue was resolved in NixOS unstable version 25.11 and version 25.05.
End of life: 12/10/2025, Latest version: 2.32.8
End of life: 10/7/2025, Latest version: 2.31.5
Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be very taxing on the infrastructure when large evaluations are done, introducing potential denial of service attacks on the host running the evaluator. This issue has been patched by commit f7bda02. A workaround involves blocking /api/push-github and /api/push-gitea via a reverse proxy.
Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-party project as part of its build process. This also happens in other places like with hydra-release-name. This issue has been patched by commit dea1e16. A workaround involves either not building untrusted packages or not visiting the builds page.
End of life: 8/25/2025, Latest version: 2.30.5
End of life: 12/31/2025
End of life: 7/7/2025, Latest version: 2.29.4
Hydra is a Continuous Integration service for Nix based projects. Evaluation of untrusted non-flake nix code could potentially access secrets that are accessible by the hydra user/group. This should not affect the signing keys, that are owned by the hydra-queue-runner and hydra-www users respectively.
make-initrd-ng is a tool for copying binaries and their dependencies. Local privilege escalation affecting all NixOS users. With systemd.shutdownRamfs.enable enabled (the default) a local user is able to create a program that will be executed by root during shutdown. Patches exist for NixOS 24.11 and 25.05 / unstable. As a workaround, set systemd.shutdownRamfs.enable = false;.
End of life: 5/14/2025, Latest version: 2.28.7
End of life: 4/4/2025, Latest version: 2.27.1
End of life: 3/21/2025, Latest version: 2.26.4
A flaw was found in rsync. When using the --safe-links option, rsync fails to properly verify if a symbolic link destination contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the --inc-recursive option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the --inc-recursive option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.
A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAXDIGESTLEN exceeds the fixed SUMLENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.
End of life: 6/30/2025
End of life: 6/30/2025
End of life: 1/22/2025, Latest version: 2.25.5
End of life: 1/22/2025, Latest version: 2.25.5