CVE-2024-27297
published 2026-04-08CVE-2024-27297: Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix…
PriorityP433medium5.9CVSS 3.1
AVNACHPRNUINSUCNIHAN
EPSS
0.59%
43.9th percentile
Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation's output contents. In multi-user installations, this allows all users able to submit builds to the Nix daemon (allowed-users - defaulting to all users) to gain root privileges by modifying sensitive files. This vulnerability is fixed in 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6.
Affected
32 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | guix | < guix 1.2.0-4+deb11u2 (bullseye) | guix 1.2.0-4+deb11u2 (bullseye) |
| debian | nix | < guix 1.2.0-4+deb11u2 (bullseye) | guix 1.2.0-4+deb11u2 (bullseye) |
| debian | nix | — | — |
| gnu | guix | >= 0 < 1.2.0-4+deb11u2 | 1.2.0-4+deb11u2 |
| nixos | nix | < 2.3.18 | 2.3.18 |
| nixos | nix | — | — |
| nixos | nix | — | — |
| nixos | nix | — | — |
| nixos | nix | — | — |
| nixos | nix | — | — |
| nixos | nix | — | — |
| nixos | nix | — | — |
| nixos | nix | — | — |
| nixos | nix | — | — |
| nixos | nix | — | — |
| nixos | nix | >= 0 < 2.22.1+dfsg-1 | 2.22.1+dfsg-1 |
| nixos | nix | >= 0 < 2.22.1+dfsg-1 | 2.22.1+dfsg-1 |
| nixos | nix | >= 0 < 2.6.0+dfsg-3ubuntu0.1~esm1 | 2.6.0+dfsg-3ubuntu0.1~esm1 |
| nixos | nix | >= 0 < 2.18.1+dfsg-1ubuntu5+esm2 | 2.18.1+dfsg-1ubuntu5+esm2 |
| nixos | nix | 2.18.2 – 2.18.9 | — |
| nixos | nix | >= 2.19.0 < 2.19.4 | 2.19.4 |
| nixos | nix | 2.19.4 – 2.19.7 | — |
| nixos | nix | >= 2.20.0 < 2.20.5 | 2.20.5 |
| nixos | nix | 2.20.5 – 2.20.9 | — |
| nixos | nix | >= 2.21.0 < 2.28.6 | 2.28.6 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
osv5.9MEDIUM
vendor_debian6.3MEDIUM
vendor_ubuntu6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2026-39860: Nix is a package manager for Linux and other Unix systems
osv·2026-04-08·CVSS 5.9
CVE-2026-39860 [MEDIUM] CVE-2026-39860: Nix is a package manager for Linux and other Unix systems
Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation's output c
OSV
nix vulnerabilities
osv·2025-07-14·CVSS 5.9
CVE-2024-38531 [MEDIUM] nix vulnerabilities
nix vulnerabilities
Linus Heckemann discovered that Nix did not correctly handle certain
binaries. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2024-38531)
Pierre-Etienne Meunier discovered that Nix did not correctly handle TLS
certificates. A remote attacker could possibly use this issue to leak
sensitive information. (CVE-2024-47174)
It was discovered that Nix did not correctly handle Unix sockets. An
attacker could possibly use this issue execute arbitrary code. This issue
only affected Ubuntu 24.04 LTS. (CVE-2024-27297)
It was discovered that Nix did not correctly handle unpacking Nix
archives (NARS). If a user or automated system were tricked into opening
a specially crafted file, an attacker could possibly use this issue to
cause a denial of service o
OSV
CVE-2024-27297: Nix is a package manager for Linux and other Unix systems
osv·2024-03-11·CVSS 5.9
CVE-2024-27297 [MEDIUM] CVE-2024-27297: Nix is a package manager for Linux and other Unix systems
Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as "valid" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Debian
CVE-2026-39860: nix - Nix is a package manager for Linux and other Unix systems. A bug in the fix for ...
vendor_debian·2026·CVSS 6.3
CVE-2026-39860 [MEDIUM] CVE-2026-39860: nix - Nix is a package manager for Linux and other Unix systems. A bug in the fix for ...
Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation's output c
Ubuntu
Nix vulnerabilities
vendor_ubuntu·2025-07-14·CVSS 6.3
CVE-2024-27297 [MEDIUM] Nix vulnerabilities
Title: Nix vulnerabilities
Summary: Several security issues were fixed in Nix.
Linus Heckemann discovered that Nix did not correctly handle certain
binaries. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2024-38531)
Pierre-Etienne Meunier discovered that Nix did not correctly handle TLS
certificates. A remote attacker could possibly use this issue to leak
sensitive information. (CVE-2024-47174)
It was discovered that Nix did not correctly handle Unix sockets. An
attacker could possibly use this issue execute arbitrary code. This issue
only affected Ubuntu 24.04 LTS. (CVE-2024-27297)
It was discovered that Nix did not correctly handle unpacking Nix
archives (NARS). If a user or automated system were tricked into opening
a specially crafted file, an attacker
Debian
CVE-2024-27297: guix - Nix is a package manager for Linux and other Unix systems. A fixed-output deriva...
vendor_debian·2024·CVSS 6.3
CVE-2024-27297 [MEDIUM] CVE-2024-27297: guix - Nix is a package manager for Linux and other Unix systems. A fixed-output deriva...
Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as "valid" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Scope: local
bullseye: resolved (fixed in 1.2.0-4+deb11u2)
sid: resolved (fixed in 1.4.0-6)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-39860 nix: privilege escalation via symlink following during output registration
bugzilla·2026-04-08·CVSS 6.3
CVE-2026-39860 [MEDIUM] CVE-2026-39860 nix: privilege escalation via symlink following during output registration
CVE-2026-39860 nix: privilege escalation via symlink following during output registration
Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namesp
Wiz
CVE-2026-39860 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.3
CVE-2026-39860 [MEDIUM] CVE-2026-39860 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-39860 :
Linux Debian vulnerability analysis and mitigation
Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow
https://github.com/NixOS/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9https://github.com/NixOS/nix/commit/4bc5a3510fa3735798f9ed3a2a30a3ea7b32343ahttps://github.com/NixOS/nix/commit/7794354a982449927ee7401cdeb573ddd16c4688https://github.com/NixOS/nix/commit/a3163b9eabb952b4aa96e376dea95ebcca97b31ahttps://github.com/NixOS/nix/pull/10178https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj
2026-04-08
Published