{"id":"CVE-2024-38531","aliases":["DEBIAN-CVE-2024-38531","EUVD-2024-37395","GHSA-q82p-44mg-mgh5","UBUNTU-CVE-2024-38531","USN-7633-1"],"status":"published","title":"Nix sandbox escape","description":"Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change the permissions of the build directory. After creating a setuid binary in a globally accessible location, a malicious local user can assume the permissions of a Nix daemon worker and hijack all future builds. This issue was patched in version(s) 2.23.1, 2.22.2, 2.21.3, 2.20.7, 2.19.5 and 2.18.4.","severity":{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00143,"percentile":0.03675,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-278"],"published":"2024-06-28T13:18:58Z","modified":"2026-11-02T12:02:42Z","fixes":[{"ecosystem":"Debian:13","package":"nix","fixed_in":["2.23.3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nix","fixed_in":["2.23.3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nix","fixed_in":["2.6.0+dfsg-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"nix","fixed_in":["2.18.1+dfsg-1ubuntu5+esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.1+dfsg-1","2.16.1+dfsg-2","2.16.1+dfsg-3","2.17.1+dfsg-1","2.18.1+dfsg-1","2.22.1+dfsg-1","2.23.3+dfsg-1","2.23.3+dfsg-2","2.24.12+dfsg-1","2.24.8+dfsg-1","2.24.9+dfsg-1","2.24.9+dfsg-2","2.25.4+dfsg-1","2.26.3+dfsg-1","2.32.5+dfsg-1","2.32.5+dfsg-2","2.34.3+dfsg-1","2.34.6+dfsg-1","2.34.8+dfsg-1","2.35.4+dfsg-1","2.8.0-1.1"]},{"source":"osv","ecosystem":"Debian:13","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23.3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23.3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0+dfsg-3ubuntu0.1~esm1"}]}],"versions":["2.3.10+dfsg1-1","2.3.10+dfsg1-1build1","2.6.0+dfsg-2","2.6.0+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.1+dfsg-1ubuntu5+esm2"}]}],"versions":["2.16.1+dfsg-3ubuntu1","2.18.1+dfsg-1ubuntu1","2.18.1+dfsg-1ubuntu2","2.18.1+dfsg-1ubuntu4","2.18.1+dfsg-1ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0+dfsg-3ubuntu0.1~esm1"}]}],"versions":["2.3.10+dfsg1-1","2.3.10+dfsg1-1build1","2.6.0+dfsg-2","2.6.0+dfsg-3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.1+dfsg-1ubuntu5+esm2"}]}],"versions":["2.16.1+dfsg-3ubuntu1","2.18.1+dfsg-1ubuntu1","2.18.1+dfsg-1ubuntu2","2.18.1+dfsg-1ubuntu4","2.18.1+dfsg-1ubuntu5"],"bundled":4}],"products":[{"vendor":"nixos","product":"nix"}],"references":[{"url":"https://github.com/NixOS/nix/security/advisories/GHSA-q82p-44mg-mgh5","tags":["x_refsource_CONFIRM","x_transferred","advisory","report"]},{"url":"https://github.com/NixOS/nix/pull/10501","tags":["x_refsource_MISC","x_transferred","fix","report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38531.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38531","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-38531","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-38531","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-38531","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7633-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-27297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47174","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-38531","title":"Nix sandbox escape","description":"Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change the permissions of the build directory. After creating a setuid binary in a globally accessible location, a malicious local user can assume the permissions of a Nix daemon worker and hijack all future builds. This issue was patched in version(s) 2.23.1, 2.22.2, 2.21.3, 2.20.7, 2.19.5 and 2.18.4.","status":"published","published":"2024-06-28T13:18:58.604Z","modified":"2024-08-02T04:12:25.386Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-278"],"updated_at":"2026-11-02T14:34:16.007021Z"}],"euvd":[{"id":"EUVD-2024-37395","description":"Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change the permissions of the build directory. After creating a setuid binary in a globally accessible location, a malicious local user can assume the permissions of a Nix daemon worker and hijack all future builds. This issue was patched in version(s) 2.23.1, 2.22.2, 2.21.3, 2.20.7, 2.19.5 and 2.18.4.","status":"published","published":"2024-06-28T13:18:58Z","modified":"2024-08-02T04:12:25Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-03T03:50:18.462935Z"}],"nvd":[{"id":"CVE-2024-38531","description":"Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change the permissions of the build directory. After creating a setuid binary in a globally accessible location, a malicious local user can assume the permissions of a Nix daemon worker and hijack all future builds. This issue was patched in version(s) 2.23.1, 2.22.2, 2.21.3, 2.20.7, 2.19.5 and 2.18.4.","status":"published","published":"2024-06-28T14:15:03.293Z","modified":"2026-06-17T07:40:28.927Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-278"],"updated_at":"2026-11-02T14:10:09.388795Z"}],"osv":[{"id":"CVE-2024-38531","title":"Nix sandbox escape","description":"Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change the permissions of the build directory. After creating a setuid binary in a globally accessible location, a malicious local user can assume the permissions of a Nix daemon worker and hijack all future builds. This issue was patched in version(s) 2.23.1, 2.22.2, 2.21.3, 2.20.7, 2.19.5 and 2.18.4.","status":"published","published":"2024-06-28T13:18:58.604Z","modified":"2026-10-28T02:31:08.060687337Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"low"}],"cwes":["CWE-278"],"updated_at":"2026-11-02T15:44:41.133403Z"},{"id":"DEBIAN-CVE-2024-38531","description":"Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change the permissions of the build directory. After creating a setuid binary in a globally accessible location, a malicious local user can assume the permissions of a Nix daemon worker and hijack all future builds. This issue was patched in version(s) 2.23.1, 2.22.2, 2.21.3, 2.20.7, 2.19.5 and 2.18.4.","status":"published","published":"2024-06-28T14:15:03.293Z","modified":"2026-11-02T12:02:42.326157923Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T15:45:42.835825Z"},{"id":"UBUNTU-CVE-2024-38531","description":"Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change the permissions of the build directory. After creating a setuid binary in a globally accessible location, a malicious local user can assume the permissions of a Nix daemon worker and hijack all future builds. This issue was patched in version(s) 2.23.1, 2.22.2, 2.21.3, 2.20.7, 2.19.5 and 2.18.4.","status":"published","published":"2024-06-28T14:15:00Z","modified":"2026-02-04T02:59:13.840685Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T16:54:54.69008Z"},{"id":"USN-7633-1","title":"nix vulnerabilities","description":"Linus Heckemann discovered that Nix did not correctly handle certain\nbinaries. An attacker could possibly use this issue to execute\narbitrary code. (CVE-2024-38531)\n\nPierre-Etienne Meunier discovered that Nix did not correctly handle TLS\ncertificates. A remote attacker could possibly use this issue to leak\nsensitive information. (CVE-2024-47174)\n\nIt was discovered that Nix did not correctly handle Unix sockets. An\nattacker could possibly use this issue execute arbitrary code. This issue\nonly affected Ubuntu 24.04 LTS. (CVE-2024-27297)\n\nIt was discovered that Nix did not correctly handle unpacking Nix\narchives (NARS). If a user or automated system were tricked into opening\na specially crafted file, an attacker could possibly use this issue to\ncause a denial of service or execute arbitrary code. (CVE-2024-45593)","status":"published","published":"2025-07-14T00:19:28Z","modified":"2026-04-27T18:08:59.766995Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}