CVE-2024-27297: Nixos Nix Privilege Escalation Vulnerability

CVE-2024-27297 Overview

CVE-2024-27297 is a race condition vulnerability in Nix, a package manager used by Linux and other Unix systems. The flaw affects fixed-output derivations on Linux, which can transmit file descriptors to files in the Nix store through Unix domain sockets in the abstract namespace. A cooperating process can then modify the derivation output after Nix has already registered the store path as valid and immutable. This breaks the core integrity guarantee of fixed-output derivations, which are supposed to produce bit-for-bit reproducible content. The issue is categorized as a Time-of-Check Time-of-Use (TOCTOU) weakness [CWE-367] and is fixed in Nix versions 2.3.18, 2.18.2, 2.19.4, and 2.20.5.

Critical Impact
Attackers can tamper with validated Nix store paths, undermining supply chain integrity and reproducibility guarantees for any package built via fixed-output derivations.

Affected Products

Nix versions prior to 2.3.18
Nix versions 2.18.0 through 2.18.1
Nix versions 2.19.0 through 2.19.3 and 2.20.0 through 2.20.4

Discovery Timeline

2024-03-11 - CVE-2024-27297 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-27297

Vulnerability Analysis

Nix fixed-output derivations declare a known content hash before the build runs. The builder executes in a sandbox and writes output to a path in the Nix store. Once the hash matches, Nix marks the path as valid and immutable in its database.

The vulnerability stems from the builder's ability to leak file descriptors referencing store paths to processes outside the sandbox via abstract Unix domain sockets. After Nix validates the hash and registers the path, the external process writes new data through the retained descriptor. The store path then holds attacker-controlled content while retaining its trusted status. This defeats reproducibility and allows malicious binaries, source archives, or dependencies to enter downstream builds.

Root Cause

The root cause is a classic Time-of-Check Time-of-Use flaw. Nix verifies output integrity at registration time but does not guarantee that the file remains unchanged afterward. Abstract-namespace Unix sockets allow descriptor passing across the sandbox boundary without filesystem traces, enabling the mutation window.

Attack Vector

An attacker-authored derivation opens an abstract socket inside the sandbox, sends a writable descriptor for its output file to a cooperating host process, and exits cleanly. Nix validates and registers the output. The cooperating process then overwrites the file contents through the descriptor, poisoning the store entry.

text

// Patch excerpt: src/libstore/build/local-derivation-goal.cc
            [&](const DerivationOutput::CAFixed & dof) {
                auto & wanted = dof.ca.hash;

+               // Replace the output by a fresh copy of itself to make sure
+               // that there's no stale file descriptor pointing to it
+               Path tmpOutput = actualPath + ".tmp";
+               copyFile(actualPath, tmpOutput, true);
+               renameFile(tmpOutput, actualPath);
+
                auto newInfo0 = newInfoFromCA(DerivationOutput::CAFloating {
                    .method = dof.ca.method,
                    .hashAlgo = wanted.algo,

The fix copies the output to a new file and renames it over the original, invalidating any file descriptors held by external processes. Source: NixOS/nix commit f8170ce.

Detection Methods for CVE-2024-27297

Indicators of Compromise

Unexpected processes connecting to abstract Unix domain sockets (socket paths beginning with a null byte) during Nix builds.
Nix store paths whose on-disk SHA matches the registered narHash immediately after build but diverges on subsequent recomputation.
Nix daemon logs showing fixed-output derivations completing successfully from untrusted or newly introduced derivation sources.

Detection Strategies

Recompute hashes of store paths produced by fixed-output derivations and compare them against the hashes recorded in the Nix database.
Audit builder processes for unexpected socket(AF_UNIX, SOCK_STREAM) calls followed by sendmsg with SCM_RIGHTS ancillary data.
Monitor the Nix daemon for abstract-namespace socket usage, which legitimate derivations rarely require.

Monitoring Recommendations

Enable auditd rules on build hosts to log sendmsg syscalls that transfer file descriptors across process boundaries.
Track installations of Nix across endpoints and flag versions below 2.3.18, 2.18.2, 2.19.4, or 2.20.5.
Alert on store path modification events occurring after the derivation goal has completed.

How to Mitigate CVE-2024-27297

Immediate Actions Required

Upgrade Nix to 2.3.18, 2.18.2, 2.19.4, 2.20.5, or later immediately.
Audit recently built fixed-output derivations and rebuild from trusted sources after upgrading.
Restrict permission to add arbitrary derivations to multi-user Nix daemons through the trusted-users and allowed-users settings.

Patch Information

The fix is published in commit f8170ce9 and documented in GHSA-2ffj-w4mj-pg37. The patch introduces a copyFile helper and replaces each fixed-output derivation result with a fresh copy before registration, invalidating any file descriptors held by external processes.

Workarounds

No vendor-supplied workarounds exist; upgrading is the only remediation path per the NixOS security advisory.
As a defense-in-depth measure, limit which users can submit derivations to the Nix daemon until patched versions are deployed.

bash

# Verify installed Nix version and upgrade
nix --version

# Single-user installation upgrade
sh <(curl -L https://nixos.org/nix/install) --no-daemon

# Multi-user / NixOS: pin a patched release in configuration.nix
# nix.package = pkgs.nixVersions.nix_2_20;
sudo nixos-rebuild switch