CVE-2025-32438: NixOS Privilege Escalation Vulnerability

CVE-2025-32438 Overview

CVE-2025-32438 is a local privilege escalation vulnerability in make-initrd-ng, a tool used by NixOS to copy binaries and their dependencies into the initramfs. The flaw affects all NixOS installations that have systemd.shutdownRamfs.enable set to true, which is the default configuration. A local unprivileged user can stage a program that root will execute during system shutdown, resulting in code execution with root privileges. Patches are available for NixOS 24.11 and 25.05 / unstable. The root cause is tracked under CWE-378: Creation of Temporary File With Insecure Permissions.

Critical Impact
Any local user on a default NixOS system can escalate to root by planting a payload that the shutdown ramfs executes during system shutdown.

Affected Products

NixOS 24.11 (prior to backport patch)
NixOS 25.05 / unstable (prior to fix)
Nixpkgs make-initrd-ng package with default systemd.shutdownRamfs.enable = true

Discovery Timeline

2025-04-15 - CVE-2025-32438 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32438

Vulnerability Analysis

The vulnerability resides in how NixOS builds the shutdown ramfs used by systemd to gracefully terminate the system. When systemd.shutdownRamfs.enable is true, systemd pivots into /run/initramfs and executes binaries from that filesystem during shutdown. The tmpfs mount backing this directory was created without a restrictive mode, leaving it world-writable in effect. This allowed any local user to place or modify executables that root would later invoke during shutdown. The attack is local and requires low privileges, but the impact spans confidentiality, integrity, and availability at the root level.

Root Cause

The root cause is insecure temporary file permissions [CWE-378] on the shutdown initramfs tmpfs mount. The NixOS module nixos/modules/system/boot/systemd/shutdown.nix declared the mount without an options field specifying restrictive permissions. As a result, file permissions inside /run/initramfs were not adequately protected against modification by non-root users. A separate change in pkgs/build-support/kernel/make-initrd-ng was required to restore stripped file permissions on files copied into the ramfs.

Attack Vector

A local user with shell access writes or replaces an executable inside /run/initramfs that will be invoked by the shutdown sequence. When the system shuts down, systemd pivots to the ramfs and runs the planted payload as root, granting the attacker full control over the machine at the next reboot or shutdown event. No user interaction beyond the ordinary shutdown flow is required.

nix

// Security patch in nixos/modules/system/boot/systemd/shutdown.nix
// Restores restrictive permissions on the shutdown ramfs tmpfs mount
        what = "tmpfs";
        where = "/run/initramfs";
        type = "tmpfs";
+       options = "mode=0700";
      }
    ];

Source: NixOS/nixpkgs commit b1759019

Detection Methods for CVE-2025-32438

Indicators of Compromise

Unexpected files or executables present under /run/initramfs created by non-root UIDs.
Modification timestamps on /run/initramfs contents that predate a shutdown event and originate from user sessions.
Shutdown logs showing execution of binaries not shipped by the NixOS shutdown ramfs build.

Detection Strategies

Audit the mount options of /run/initramfs using mount | grep initramfs and verify mode=0700 is applied on patched systems.
Monitor process execution during the shutdown phase for binaries with unusual paths or hashes under /run/initramfs.
Use file integrity monitoring on the shutdown ramfs staging directory to flag writes by non-root users.

Monitoring Recommendations

Enable Linux audit rules on /run/initramfs to record open, write, and execve events with the associated UID.
Collect systemd journal entries for the systemd-shutdown unit and forward them to a central log store for review.
Alert on any process execution during shutdown that runs as root with a parent chain originating from user-writable paths.

How to Mitigate CVE-2025-32438

Immediate Actions Required

Update Nixpkgs to a revision that includes the fix in nixos/modules/system/boot/systemd/shutdown.nix and rebuild the system with nixos-rebuild switch.
On unpatched systems, disable the shutdown ramfs by setting systemd.shutdownRamfs.enable = false; in the NixOS configuration.
Verify that /run/initramfs is mounted with mode=0700 after applying the update.

Patch Information

The fix is delivered through two Nixpkgs commits. Commit b1759019 backports the change to the stable branch, and commit fbf76bf7 lands the fix on unstable. Both patches add options = "mode=0700" to the /run/initramfs tmpfs declaration and restore stripped file permissions in make-initrd-ng. Full advisory details are available in the GitHub Security Advisory GHSA-m7pq-h9p4-8rr4.

Workarounds

Set systemd.shutdownRamfs.enable = false; in configuration.nix until the patch is applied.
Restrict local shell access on multi-user NixOS hosts until the update is in place.
Manually remount /run/initramfs with mode=0700 on running systems as a temporary control.

bash

# Temporary workaround: disable shutdown ramfs in configuration.nix
{ config, pkgs, ... }:
{
  systemd.shutdownRamfs.enable = false;
}

# Apply the change
sudo nixos-rebuild switch