References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Change History

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.

AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

CWE-61

CWE-367

https://github.com/NixOS/nix/commit/26679828f74ee6e82a4100904e6361f993ff5390

https://github.com/NixOS/nix/pull/15401

https://github.com/NixOS/nix/security/advisories/GHSA-6h4g-g5j9-fm5f

[{"vendor":"NixOS","product":"nix","versions":[{"version":"< 2.35.0","status":"affected"}]}]