CVE-2024-38531

Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change the permissions of the build directory. After creating a setuid binary in a globally accessible location, a malicious local user can assume the permissions of a Nix daemon worker and hijack all future builds. This issue was patched in version(s) 2.23.1, 2.22.2, 2.21.3, 2.20.7, 2.19.5 and 2.18.4.

CVSS v3 3.6 LOW

3.6^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.0 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/NixOS/nix/pull/10501
https://github.com/NixOS/nix/security/advisories/GHSA-q82p-44mg-mgh5
https://github.com/NixOS/nix/pull/10501
https://github.com/NixOS/nix/security/advisories/GHSA-q82p-44mg-mgh5

Configurations

No configuration.

History

21 Nov 2024, 09:26

Type	Values Removed	Values Added
References	~~() https://github.com/NixOS/nix/pull/10501 -~~	() https://github.com/NixOS/nix/pull/10501 -
References	~~() https://github.com/NixOS/nix/security/advisories/GHSA-q82p-44mg-mgh5 -~~	() https://github.com/NixOS/nix/security/advisories/GHSA-q82p-44mg-mgh5 -

01 Jul 2024, 12:37

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-06-28 14:15

Updated : 2024-11-21 09:26

NVD link : CVE-2024-38531

Mitre link : CVE-2024-38531

CVE.ORG link : CVE-2024-38531

JSON object : View

Products Affected

No product.

CWE

CWE-278

Insecure Preserved Inherited Permissions

{"id": "CVE-2024-38531", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.6, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 1.0}]}, "published": "2024-06-28T14:15:03.293", "references": [{"url": "https://github.com/NixOS/nix/pull/10501", "source": "security-advisories@github.com"}, {"url": "https://github.com/NixOS/nix/security/advisories/GHSA-q82p-44mg-mgh5", "source": "security-advisories@github.com"}, {"url": "https://github.com/NixOS/nix/pull/10501", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/NixOS/nix/security/advisories/GHSA-q82p-44mg-mgh5", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-278"}]}], "descriptions": [{"lang": "en", "value": "Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change the permissions of the build directory. After creating a setuid binary in a globally accessible location, a malicious local user can assume the permissions of a Nix daemon worker and hijack all future builds. This issue was patched in version(s) 2.23.1, 2.22.2, 2.21.3, 2.20.7, 2.19.5 and 2.18.4."}, {"lang": "es", "value": "Nix es un administrador de paquetes para Linux y otros sistemas Unix que hace que la administraci\u00f3n de paquetes sea confiable y reproducible. Un proceso de compilaci\u00f3n tiene acceso y puede cambiar los permisos del directorio de compilaci\u00f3n. Despu\u00e9s de crear un binario setuid en una ubicaci\u00f3n accesible globalmente, un usuario local malicioso puede asumir los permisos de un daemon trabajador de Nix y secuestrar todas las compilaciones futuras. Este problema se solucion\u00f3 en las versiones 2.23.1, 2.22.2, 2.21.3, 2.20.7, 2.19.5 y 2.18.4."}], "lastModified": "2024-11-21T09:26:13.403", "sourceIdentifier": "security-advisories@github.com"}