CVE-2025-52993: Nix, Lix, Guix Race Condition Vulnerability

CVE-2025-52993 Overview

CVE-2025-52993 is a race condition vulnerability affecting the Nix, Lix, and Guix package managers. The flaw allows a local attacker to change ownership of arbitrary files to the UID and GID of the build user, such as nixbld* or guixbuild*. Exploitation abuses a Time-of-Check Time-of-Use (TOCTOU) window during the package build process, which the daemon executes with elevated privileges. Because build users participate in privileged file operations, hijacking ownership of sensitive files can enable local privilege escalation on multi-user Nix, Lix, or Guix installations.

Critical Impact
A local user can win a race in the package manager daemon to reassign ownership of arbitrary files on disk to build-user accounts, creating a path to privilege escalation.

Affected Products

Nix versions prior to 2.24.15, 2.26.4, 2.28.4, and 2.29.1
Lix versions prior to 2.91.2, 2.92.2, and 2.93.1
Guix versions prior to 1.4.0-38.0e79d5b

Discovery Timeline

2025-06-27 - CVE-2025-52993 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52993

Vulnerability Analysis

CVE-2025-52993 is a race condition classified under [CWE-362]. The Nix, Lix, and Guix package managers execute builds inside sandboxed environments using unprivileged build users (nixbld* for Nix and Lix, guixbuild* for Guix). The daemon performs privileged file operations, including ownership changes, on behalf of these builds. An attacker with local access can manipulate the file system state between the daemon's validation check and the ownership operation. Winning that race causes the daemon to apply chown to a file the attacker controls by path rather than the intended target inside the build sandbox.

Once ownership is transferred to a build UID, an attacker running as, or able to influence, that build user can modify the file. If the file is a shell profile, cron job, or binary consumed by a privileged process, the vulnerability becomes a stepping stone to root escalation. The scope-changed rating in the CVSS vector reflects this crossing of trust boundaries between the daemon, the sandbox, and the host file system.

Root Cause

The root cause is non-atomic handling of file paths during privileged ownership operations inside the package manager daemon. Path resolution and the subsequent chown call are separated in time, and the daemon does not adequately pin the target inode. An attacker can substitute a symbolic link or replace a directory component between the check and the use, redirecting the ownership change to a file outside the intended build output.

Attack Vector

Exploitation requires local access to a system running a vulnerable Nix, Lix, or Guix daemon with the multi-user build configuration enabled. The attacker submits a crafted derivation or build request and concurrently manipulates paths on the file system to swap the target of the ownership operation. High attack complexity reflects the timing precision required to consistently win the race. No user interaction is required, and no prior authentication to the daemon is needed beyond the ability to invoke a build.

No public exploit code is currently available. For technical details, refer to the NixOS Security Advisory, the Lix Blog on CVEs, and the Guix Blog on Vulnerabilities.

Detection Methods for CVE-2025-52993

Indicators of Compromise

Files outside the Nix, Lix, or Guix store owned by nixbld* or guixbuild* UIDs and GIDs where they should not be
Unexpected chown audit events originating from the package manager daemon targeting paths outside /nix/store or /gnu/store
Symbolic links or renamed directory components inside build working directories that resolve to sensitive system paths
Anomalous concurrent activity from a local user during package builds

Detection Strategies

Enable Linux audit rules on chown, fchown, and chownat syscalls issued by the nix-daemon or guix-daemon processes and alert on targets outside expected store paths
File integrity monitoring on /etc, /root, and user home directories to flag ownership drift toward build user accounts
Correlate build submissions with subsequent ownership changes on non-store paths within a short time window

Monitoring Recommendations

Forward daemon logs and Linux audit records to a centralized SIEM for retention and correlation across build events
Baseline the expected UID and GID ownership map for critical directories and alert on deviations
Monitor the version banner reported by nix --version, lix --version, and guix --version across the fleet to identify unpatched hosts

How to Mitigate CVE-2025-52993

Immediate Actions Required

Upgrade Nix to 2.24.15, 2.26.4, 2.28.4, or 2.29.1 or later, Lix to 2.91.2, 2.92.2, or 2.93.1 or later, and Guix to 1.4.0-38.0e79d5b or later
Restart the nix-daemon or guix-daemon service after upgrading to ensure the patched binary is active
Audit systems for files owned by build user accounts outside the package store and restore correct ownership
Restrict local shell access on multi-user build hosts to trusted operators until patches are applied

Patch Information

Upstream fixes are published by each project. Consult the NixOS Security Advisory, the Lix Blog on CVEs, and the Guix Blog on Vulnerabilities for release-specific patch commits. Distribution package updates are tracked in the Debian CVE Tracker Entry.

Workarounds

Operate the package manager in single-user mode where feasible, eliminating the privileged daemon path exercised by the race
Deny non-administrative local users the ability to submit builds to the shared daemon on multi-tenant systems
Apply mandatory access control policies such as AppArmor or SELinux to constrain the paths the daemon may chown

bash

# Verify installed versions on affected hosts
nix --version
guix --version

# Restart the daemon after patching (systemd example)
sudo systemctl restart nix-daemon.service
sudo systemctl restart guix-daemon.service