A vulnerability has been identified in the Nix and Lix package managers that allows code execution with the privileges of the background process, which in NixOS and multi-user installations runs as the root user. The issue (CVE not assigned) manifests in the background process nix-daemon, used to provide access for unprivileged users to build operations and the package repository.
The vulnerability arises from a lack of restriction on recursive directory processing in the code for parsing NAR (Nix Archive) files, which can be exploited to trigger stack exhaustion of coroutines and overwrite heap memory content placed after the stack without guard pages. The issue can be exploited by any user able to connect to the nix-daemon. By default, all users have this capability, allowing them to escalate their privileges to root in multi-user Nix installations.
The problem has been resolved by limiting the recursion depth to 64 nested directories, adding guard pages between the stack and heap, and implementing additional checks for symbolic links in NAR. In Nix, the vulnerability appears starting with version 2.24.4 and has been fixed in releases 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, 2.28.7. In Lix, the vulnerability was introduced in release 2.93.0 and has been fixed in updates 2.93.4, 2.94.2, and 2.95.2. The Guix package manager is not affected by this vulnerability.
Additionally, another vulnerability (CVE not assigned) has been addressed in the published Nix updates, assigned a medium severity level (4.3 out of 10). This issue manifests starting with Nix release 2.24.7 and allows writing files to an area beyond the root directory where the archive is unpacked. The vulnerability is exploited by creating elements with absolute file paths in tar files. When unpacking such archives using the command "nix-prefetch-url --unpack" or "nix store prefetch-file --unpack", files with absolute paths are extracted as-is, without being transformed into relative paths.
Source: opennet.ru
