{"id":"CVE-2024-45593","aliases":["EUVD-2024-41529","GHSA-h4vv-h3jq-v493","UBUNTU-CVE-2024-45593","USN-7633-1"],"status":"published","title":"Nix affected by unsafe NAR unpacking","description":"Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root permissions when using the Nix daemon. This issue is fixed in Nix 2.24.6.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00602,"percentile":0.49255,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2024-09-10T15:51:07Z","modified":"2026-10-28T02:30:29Z","fixes":[{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nix","fixed_in":["2.6.0+dfsg-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"nix","fixed_in":["2.18.1+dfsg-1ubuntu5+esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0+dfsg-3ubuntu0.1~esm1"}]}],"versions":["2.3.10+dfsg1-1","2.3.10+dfsg1-1build1","2.6.0+dfsg-2","2.6.0+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.1+dfsg-1ubuntu5+esm2"}]}],"versions":["2.16.1+dfsg-3ubuntu1","2.18.1+dfsg-1ubuntu1","2.18.1+dfsg-1ubuntu2","2.18.1+dfsg-1ubuntu4","2.18.1+dfsg-1ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0+dfsg-3ubuntu0.1~esm1"}]}],"versions":["2.3.10+dfsg1-1","2.3.10+dfsg1-1build1","2.6.0+dfsg-2","2.6.0+dfsg-3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"nix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.1+dfsg-1ubuntu5+esm2"}]}],"versions":["2.16.1+dfsg-3ubuntu1","2.18.1+dfsg-1ubuntu1","2.18.1+dfsg-1ubuntu2","2.18.1+dfsg-1ubuntu4","2.18.1+dfsg-1ubuntu5"],"bundled":4}],"products":[{"vendor":"nixos","product":"nix"}],"references":[{"url":"https://github.com/NixOS/nix/security/advisories/GHSA-h4vv-h3jq-v493","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","report"]},{"url":"https://github.com/NixOS/nix/commit/eb11c1499876cd4c9c188cbda5b1003b36ce2e59","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45593.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45593","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-45593","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-45593","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7633-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-27297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47174","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-45593","title":"Nix affected by unsafe NAR unpacking","description":"Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root permissions when using the Nix daemon. This issue is fixed in Nix 2.24.6.","status":"published","published":"2024-09-10T15:51:07.881Z","modified":"2024-09-10T16:06:16.016Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:08.16279Z"}],"euvd":[{"id":"EUVD-2024-41529","description":"Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root permissions when using the Nix daemon. This issue is fixed in Nix 2.24.6.","status":"published","published":"2024-09-10T15:51:07Z","modified":"2024-09-10T16:06:16Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:55:59.274325Z"}],"nvd":[{"id":"CVE-2024-45593","description":"Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root permissions when using the Nix daemon. This issue is fixed in Nix 2.24.6.","status":"published","published":"2024-09-10T16:15:21.76Z","modified":"2026-06-17T07:54:32.03Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:10:25.561537Z"}],"osv":[{"id":"CVE-2024-45593","title":"Nix affected by unsafe NAR unpacking","description":"Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root permissions when using the Nix daemon. This issue is fixed in Nix 2.24.6.","status":"published","published":"2024-09-10T15:51:07.881Z","modified":"2026-11-11T10:47:18.237089051Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-11T02:50:43.46164Z"},{"id":"UBUNTU-CVE-2024-45593","description":"Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root permissions when using the Nix daemon. This issue is fixed in Nix 2.24.6.","status":"published","published":"2024-09-10T16:15:00Z","modified":"2026-02-04T03:26:50.322985Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:02.636559Z"},{"id":"USN-7633-1","title":"nix vulnerabilities","description":"Linus Heckemann discovered that Nix did not correctly handle certain\nbinaries. An attacker could possibly use this issue to execute\narbitrary code. (CVE-2024-38531)\n\nPierre-Etienne Meunier discovered that Nix did not correctly handle TLS\ncertificates. A remote attacker could possibly use this issue to leak\nsensitive information. (CVE-2024-47174)\n\nIt was discovered that Nix did not correctly handle Unix sockets. An\nattacker could possibly use this issue execute arbitrary code. This issue\nonly affected Ubuntu 24.04 LTS. (CVE-2024-27297)\n\nIt was discovered that Nix did not correctly handle unpacking Nix\narchives (NARS). If a user or automated system were tricked into opening\na specially crafted file, an attacker could possibly use this issue to\ncause a denial of service or execute arbitrary code. (CVE-2024-45593)","status":"published","published":"2025-07-14T00:19:28Z","modified":"2026-04-27T18:08:59.766995Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}