High severity · published Sep 10, 2024
CVE-2024-45593
Nix affected by unsafe NAR unpacking
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root permissions when using the Nix daemon. This issue is fixed in Nix 2.24.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NI
nix · NixOS
>= 2.24.0, < 2.24.6 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45593
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45593
Patch
https://github.com/NixOS/nix/commit/eb11c1499876cd4c9c188cbda5b1003b36ce2e59
Vendor Advisory
https://github.com/NixOS/nix/security/advisories/GHSA-h4vv-h3jq-v493
More from nix
8.4
CVE-2026-39860
Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination
8.0
CVE-2026-110450
Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification
7.9
CVE-2025-53819
Nix's privilege dropping to build user broke for macOS
7.8
CVE-2019-17365
Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable
7.5
CVE-2026-110449
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled