{"id":"CVE-2024-27297","aliases":["ALPINE-CVE-2024-27297","DEBIAN-CVE-2024-27297","DSA-5669-1","EUVD-2024-24524","GHSA-2ffj-w4mj-pg37","UBUNTU-CVE-2024-27297","USN-7633-1","USN-8773-1"],"status":"published","title":"Nix Corruption of fixed-output derivations","description":"Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as \"valid\" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00586,"percentile":0.48504,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-367"],"published":"2024-03-11T21:24:43Z","modified":"2026-11-03T06:32:59Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"guix","fixed_in":["1.4.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"guix","fixed_in":["1.4.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"guix","fixed_in":["1.4.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"guix","fixed_in":["1.4.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"guix","fixed_in":["1.4.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"guix","fixed_in":["1.4.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nix","fixed_in":["2.20.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nix","fixed_in":["2.20.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nix","fixed_in":["2.20.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nix","fixed_in":["2.20.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nix","fixed_in":["2.20.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nix","fixed_in":["2.22.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nix","fixed_in":["2.22.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"guix","fixed_in":["1.2.0-4+deb11u2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"guix","fixed_in":["1.4.0-3+deb12u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"guix","fixed_in":["1.3.0-4ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"nix","fixed_in":["2.18.1+dfsg-1ubuntu5+esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"guix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"guix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"guix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"guix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"guix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"guix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4"},{"fixed":"2.20.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4"},{"fixed":"2.20.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4"},{"fixed":"2.20.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4"},{"fixed":"2.20.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4"},{"fixed":"2.20.5-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.1+dfsg-1","2.16.1+dfsg-2","2.16.1+dfsg-3","2.17.1+dfsg-1","2.18.1+dfsg-1","2.22.1+dfsg-1","2.23.3+dfsg-1","2.23.3+dfsg-2","2.24.12+dfsg-1","2.24.8+dfsg-1","2.24.9+dfsg-1","2.24.9+dfsg-2","2.25.4+dfsg-1","2.26.3+dfsg-1","2.32.5+dfsg-1","2.32.5+dfsg-2","2.34.3+dfsg-1","2.34.6+dfsg-1","2.34.8+dfsg-1","2.35.4+dfsg-1","2.8.0-1.1"]},{"source":"osv","ecosystem":"Debian:13","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"guix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-4+deb11u2"}]}],"versions":["1.2.0-4","1.2.0-4+deb11u1"]},{"source":"osv","ecosystem":"Debian:12","package":"guix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-3+deb12u1"}]}],"versions":["1.4.0-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"guix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-4ubuntu0.1~esm1"}]}],"versions":["1.2.0-4","1.3.0-2","1.3.0-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.1+dfsg-1ubuntu5+esm2"}]}],"versions":["2.16.1+dfsg-3ubuntu1","2.18.1+dfsg-1ubuntu1","2.18.1+dfsg-1ubuntu2","2.18.1+dfsg-1ubuntu4","2.18.1+dfsg-1ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0+dfsg-3ubuntu0.1~esm1"}]}],"versions":["2.3.10+dfsg1-1","2.3.10+dfsg1-1build1","2.6.0+dfsg-2","2.6.0+dfsg-3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.1+dfsg-1ubuntu5+esm2"}]}],"versions":["2.16.1+dfsg-3ubuntu1","2.18.1+dfsg-1ubuntu1","2.18.1+dfsg-1ubuntu2","2.18.1+dfsg-1ubuntu4","2.18.1+dfsg-1ubuntu5"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"guix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-4ubuntu0.1~esm1"}]}],"versions":["1.2.0-4","1.3.0-2","1.3.0-4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"guix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-6ubuntu0.1~esm1"}]}],"versions":["1.4.0-5","1.4.0-6","1.4.0-6build1"],"bundled":2}],"products":[{"vendor":"nixos","product":"nix"}],"references":[{"url":"https://github.com/NixOS/nix/security/advisories/GHSA-2ffj-w4mj-pg37","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://github.com/NixOS/nix/commit/f8170ce9f119e5e6724eb81ff1b5a2d4c0024000","tags":["x_refsource_MISC","x_transferred","Patch","fix","report"]},{"url":"https://hackmd.io/03UGerewRcy3db44JQoWvw","tags":["x_refsource_MISC","x_transferred","Exploit","web","report"]},{"url":"https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/","tags":["article"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-27297","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27297.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27297","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-27297","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-27297","tags":["report"]},{"url":"https://guix.gnu.org/en/blog/2024/fixed-output-derivation-sandbox-bypass-cve-2024-27297/","tags":["report"]},{"url":"https://github.com/NixOS/nix/commit/244f3eee0bbc7f11e9b383a15ed7368e2c4becc9","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-27297","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7633-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8773-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-38531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47174","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-52867","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-27297","title":"Nix Corruption of fixed-output derivations","description":"Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as \"valid\" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-11T21:24:43.919Z","modified":"2025-06-27T12:16:28.799Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:34:12.982241Z"}],"euvd":[{"id":"EUVD-2024-24524","description":"Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as \"valid\" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-11T21:24:43Z","modified":"2025-06-27T12:16:28Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T20:32:16.171648Z"}],"nvd":[{"id":"CVE-2024-27297","description":"Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as \"valid\" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-11T22:15:55.277Z","modified":"2026-06-17T07:19:35.82Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:09:40.831473Z"}],"osv":[{"id":"ALPINE-CVE-2024-27297","description":"Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as \"valid\" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-11T22:15:55.277Z","modified":"2026-11-03T06:32:59.804272072Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"CVE-2024-27297","title":"Nix Corruption of fixed-output derivations","description":"Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as \"valid\" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-11T21:24:43.919Z","modified":"2026-11-11T13:22:48.823834698Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"medium"}],"cwes":["CWE-367"],"updated_at":"2026-11-11T03:22:28.447808Z"},{"id":"DEBIAN-CVE-2024-27297","description":"Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as \"valid\" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-11T22:15:55.277Z","modified":"2026-11-02T12:02:00.178903803Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:42.204259Z"},{"id":"UBUNTU-CVE-2024-27297","description":"Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as \"valid\" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-11T22:15:00Z","modified":"2026-09-16T20:26:45.915755562Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"medium"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"DSA-5669-1","title":"guix - security update","status":"published","published":"2024-04-22T00:00:00Z","modified":"2026-03-09T02:11:37.917565Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"USN-7633-1","title":"nix vulnerabilities","description":"Linus Heckemann discovered that Nix did not correctly handle certain\nbinaries. An attacker could possibly use this issue to execute\narbitrary code. (CVE-2024-38531)\n\nPierre-Etienne Meunier discovered that Nix did not correctly handle TLS\ncertificates. A remote attacker could possibly use this issue to leak\nsensitive information. (CVE-2024-47174)\n\nIt was discovered that Nix did not correctly handle Unix sockets. An\nattacker could possibly use this issue execute arbitrary code. This issue\nonly affected Ubuntu 24.04 LTS. (CVE-2024-27297)\n\nIt was discovered that Nix did not correctly handle unpacking Nix\narchives (NARS). If a user or automated system were tricked into opening\na specially crafted file, an attacker could possibly use this issue to\ncause a denial of service or execute arbitrary code. (CVE-2024-45593)","status":"published","published":"2025-07-14T00:19:28Z","modified":"2026-04-27T18:08:59.766995Z","updated_at":"2026-11-02T16:58:19.988474Z"},{"id":"USN-8773-1","title":"guix vulnerability","description":"It was discovered that GNU Guix incorrectly made build outputs accessible\nto local users before their file metadata was finalized. A local attacker\ncould possibly use this issue to gain elevated privileges.","status":"published","published":"2026-09-16T11:33:38Z","modified":"2026-09-16T20:27:34.835811077Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}