CVE-2024-45593: fallo crítico en NixOS nix
Nix affected by unsafe NAR unpacking
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.1epss 0.6%
Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root permissions when using the Nix daemon. This issue is fixed in Nix 2.24.6.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Productos afectados
NixOS · nixCVEs relacionadas — NixOS nix
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-27297MEDIUMNix Corruption of fixed-output derivationsEPSS 0.6%CVE-2024-47174MEDIUMCredential leak when credentials are used with `<nix/fetchurl.nix>`EPSS 0.3%CVE-2026-39860CRITICALNix sandbox escape: file write via symlink at FOD `.tmp` copy destinationEPSS 0.2%CVE-2024-51481LOWNix allows macOS sandbox escape via built-in buildersEPSS 0.2%CVE-2025-53819HIGHNix's privilege dropping to build user broke for macOSEPSS 0.1%CVE-2024-38531LOWNix sandbox escapeEPSS 0.1%