Read the docs
TI-2024-18135 Aliases CVE-2024-27297

Nix Corruption of fixed-output derivations

Priority LOW 29CWE-367Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as "valid" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00586 48th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed nix (NixOS): 2.3.18, 2.18.2, 2.19.4 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NixOSnix2.3.0 to before 2.3.18; 2.4.0 to before 2.18.2; 2.19.0 to before 2.19.4; 2.20.0 to before 2.20.52.3.18, 2.18.2, 2.19.4, 2.20.5Patch availableCNA
  • nix VendorNixOS Affected 2.3.0 to before 2.3.18; 2.4.0 to before 2.18.2; 2.19.0 to before 2.19.4; 2.20.0 to before 2.20.5 Fixed in 2.3.18, 2.18.2, 2.19.4, 2.20.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*before 2.3.18; 2.4 to before 2.18.2; 2.19.0 to before 2.19.4; 2.20.0 to before 2.20.5VulnerableNixOS
  • cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:* Versions before 2.3.18; 2.4 to before 2.18.2; 2.19.0 to before 2.19.4; 2.20.0 to before 2.20.5 Vulnerable ·NixOS

Remediation

  • Fix · CNA nix (NixOS) Fixed in 2.3.18, 2.18.2, 2.19.4, 2.20.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-27297

References

Exploit 1

Patch 1

Advisory 1

  • TI-2024-30614 Nix affected by unsafe NAR unpacking CVSS 3.1CRITICAL 9.1
  • TI-2026-28741 Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination CVSS 3.1CRITICAL 9.0
  • TI-2019-12962 Nix through 2.3 allows local users to gain access to an arbitrary user's account because… CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences